healthcarereimagined

By Martin Checinski, Roland Dillon, Solveigh Hieronimus, and Julia Klier

It is no easy matter to bring about major change in a large, complex organization—whichever sector it’s in. McKinsey research has found that 74 percent of private-sector transformation efforts fail to meet their objectives, while in the public sector, the failure rate is even higher, at 80 percent. In both sectors, people practices are a decisive factor, often making the difference between success and disappointment. Indeed, the five key success factors for government transformations all have a strong people component (Exhibit 1).

Exhibit 1

Rachna Gandhi, a former business executive who went on to lead the Australian government agency Service NSW, put it this way: “Transformations in government are not harder than in the private sector. There are certain unique factors in both, but the toughness factor is pretty similar. Both need to emphasize bringing people on the journey and creating an emotional investment.”

Paradoxically, the importance of people practices in transformations is both good and bad news for public-sector change leaders. On the one hand, governments’ public-service mission gives them a distinct advantage over private-sector peers when it comes to mobilizing people to live their values and achieve social outcomes. On the other, there is a lot of evidence that structures and cultures in government make them more change resistant than business organizations, reducing their overall organizational health and effectiveness.

How should government leaders think about people-driven change? McKinsey research—along with the insights of successful transformation leaders—points to three essential practices:

• Take a frank look at your organization and the cultural challenges it faces.
• Start at the top: build change-leadership skills and mind-sets in yourself and your senior team.
• Nurture the right capabilities: most public-sector staff, from the transformation team to the front line, need new skills to succeed in major change efforts.

Take a frank look at the challenges of public-sector organization and culture

Organizations can measure and manage health—in other words, how well they align, execute, and renew—with the same rigor as they manage performance. McKinsey has measured the health of over 2,000 organizations in both the public and private sectors through our Organizational Health Index Survey, which to date has had over five million respondents. This research indicates that over 75 percent of public-sector organizations have below-average health. Moreover, the research makes it clear that gaps in organizational health in the public sector are particularly apparent in culture, coordination, and capabilities (Exhibit 2). Only in the dimension of leadership do public-sector organizations match the health of their private-sector peers.

Exhibit 2

In addition to disadvantages in organizational health, public-sector institutions face a series of complex people-related challenges that their private-sector counterparts have to navigate to a lesser degree. This makes their starting points and journeys quite different when it comes to engaging employees and building capabilities during transformation efforts.
First, public-sector organizations typically have more risk-averse cultures than private-sector businesses, where employees who innovate are often richly rewarded. That’s no surprise, given a risk environment in the public sector that can only be described as asymmetric: civil servants are more likely to be penalized for failure than they are to be rewarded for innovation or outperformance. For example, a bold experiment that improves a service for the majority of recipients is unlikely to win kudos for the responsible civil servants if a small number of vocal citizens complain about the change. Likewise, a public-sector manager who succeeds in improving efficiency in his or her department might be “rewarded” with a reduced budget—but punished with a poor performance review if the effort fails.
Understandably, many civil servants view ambitious change programs with extreme caution. To break through this risk aversion, public-sector leaders must work consciously to shift the organizational culture, giving senior civil servants clear mandates for change and strong performance measures tied to improved outcomes. They can also take a leaf out of the book of business leaders who celebrate failure among their employees as a necessary by-product of innovation.
A second challenge for public-sector change leaders is the limitations of political mandates. Public-sector change efforts may be held back by the extent of the government’s political mandate, which may be weak or short lived, owing to the frequency of elections. A related challenge is that public-sector leaders typically have shorter tenure than their private-sector counterparts. For example, a review of ministers of health across 23 countries from 1990 to 2009 found that half of them left office in under two years. The tenure of senior civil servants is falling too: in the United Kingdom, for example, annual churn in the cabinet office rose from 20 percent in 2010 to 35 percent in 2016. By contrast, the average tenure of CEOs of major US companies is around eight years.
In these circumstances, successful public-sector transformations require laser-like focus from leaders. McKinsey’s research shows that efforts that are focused on a small set of true priorities are much more likely to succeed than initiatives that attempt to change everything at once. Moreover, frequent turnover at the top means that successful public-sector transformations must be anchored in frontline staff—the people who continue running the organization when the leader moves on. This was the approach taken by Service NSW. The agency aimed to simplify citizen access to government services, with a shift to digital transactions and a “one-stop-shop” approach to improve customer experience. It rooted its initiatives in frontline staff, who were empowered to develop and implement improvement ideas. Because the agency’s initiatives were owned by the people who were actually going to run them, they were hugely successful: Service NSW achieved customer-satisfaction rates of 97 percent.

Would you like to learn more about our Public Sector Practice?

Visit the Government Transitions page

The third challenge is that many major change efforts must work across multiple government departments or agencies, as new-generation solutions do not usually fit neatly within existing portfolios. Each institution involved in a transformation is likely to have distinct strengths and gaps in capabilities and frequently conflicting motivations. The implication for change leaders is that they must invest time and energy in building support and collaboration from people they do not directly influence.

Whereas a private-sector CEO leading a change effort will usually have the majority of people involved within their own organization, a minister or head of department in government will need to work with several other ministers or departments. For example, an effort to improve tourism outcomes will require collaboration between the ministry of tourism and those of transport, economic development, foreign affairs, and so on—as well as with city mayors and the private sector. Indeed, McKinsey’s research finds that 70 percent of public-sector transformation efforts were scoped across more than one ministry, department, or agency.

Any government leader embarking on a major change effort must face these challenges head on—and take deliberate steps to mitigate them. Yet the public sector also has distinct advantages vis-à-vis the private sector. In particular, public-sector organizations are in a unique position to tap into talent from the broader society. For example, when Germany’s government grappled with the influx of hundreds of thousands of refugees in 2015, it was able to mobilize massive involvement from citizens and civil-society organizations. An estimated one in ten adults in Germany was involved in voluntary refugee assistance in the summer of 2015.

In India, the state of Maharashtra invited college students to come up with ideas to solve 11 critical challenges, ranging from eradicating drought to using technology to expedite justice. The Transform Maharashtra competition attracted more than 11,000 student participants. Not only do such initiatives “crowd in” ideas and capabilities from beyond the civil service, they also enable governments to drive change with fewer public resources than would otherwise be needed.

Start at the top: Build change-leadership skills and mind-sets in yourself and your senior team

The successful transformations we studied were steered and championed by deeply committed leaders. Each of them devoted considerable time and energy to the effort, took personal accountability for success or failure, was a visible role model for the change, and had the courage to challenge long-established assumptions and conventions. Such leaders live and breathe the journey and stretch their capacity for strategic planning, emotional resilience, and inspiring people leadership. They also take personal responsibility for the change. An example is Mike Bush, New Zealand’s police commissioner, who led the transformation of the country’s police services to a prevention-focused model. He told us, “You need to dedicate at least 60 percent of your time inside the organization to driving a transformation.”
None of this is easy: indeed, leading a large-scale change effort is a huge personal challenge for any senior government official. Few governments train their leaders sufficiently in the people skills needed: research by the McKinsey Center for Government (MCG) finds that fewer than a third of public-sector transformation leaders have received any training in change-leadership skills. And findings from a McKinsey survey of public- and private-sector organizations suggest that public-sector managers typically fall short in at least three important interpersonal-skill dimensions: giving feedback, motivating employees, and supporting their development. Public-sector participants in the survey were less likely than the average participant to agree that managers at their organizations were trained in these skills (Exhibit 3).

Exhibit 3

To build the leadership skills and mind-sets needed to inspire and sustain change, we recommend three key interventions whose impact has been proven across many transformation efforts.
The first is bringing senior transformation leaders together. Leading a transformation can be an isolating, unfamiliar experience; with some notable exceptions, few public servants lead more than one agency or department in their career. Many of the senior leaders we interviewed emphasized that they lacked a network of peers with whom to test ideas and share experiences. That meant they were forced to learn on the job when the stakes were extremely high. To address this challenge, some governments have created special forums to bring together leaders from across ministries and agencies to develop critical skills—and build networks to support change efforts for years to come. For example, the government of New Zealand introduced its senior civil-service leaders to digital and innovation concepts via a full-day executive class that covered topics such as digitization best practices and hiring digital talent. The training also included a live “hackathon” that allowed the participants to redesign and digitize a series of citizen interactions, using agile methods.
That points to a second key step: designing leadership-training programs that go beyond theory and give participants opportunities to practice and hone new skills in real-world settings. We have seen several public organizations follow a “field-and-forum” approach to capability building. Instead of simply providing training and assuming it will trickle into organizational practices, a field-and-forum approach provides classroom training in a series of workshops and then takes a structured approach to translating the theory into practice via hands-on projects in the field. A European labor agency, for instance, used this approach to train more than 150 managers. After the program was completed, 93 percent of participants reported that they were inspired to implement new capabilities in their daily work.

The third key thrust for leaders of transformation is to develop the skills and nurture the passion, to communicate in an inspirational way with all the groups affected by the change—especially the organization’s own employees. Of course, every government communicates, but only a few cut through the noise effectively enough to win hearts and minds. Many government institutions continue to be hierarchical organizations that follow the protocol of top-down, one-way communication cascades on the assumption that civil servants simply need clear instructions in order to act effectively. However, two-way communication and genuine engagement are what they need. The findings of MCG’s Government Transformation Survey underline this truth: in the most successful transformations, the senior-management team communicated openly and across the organization about its progress. And nearly 90 percent of transformation participants said success would have been enhanced by engaging more regularly with frontline employees.

Unlike governments’ private-sector counterparts, those that fail to deliver do not “go out of business”—and their employees are unlikely to lose their jobs. That, combined with the societal impact that effective government transformation achieves, has important implications for how public-sector leaders create internal motivation for employees to change: they must be adept at framing the transformation in a positive way. Rachna Gandhi of Service NSW put it this way: “We weren’t going out to our front line and saying that we really want to drive digital adoption, and them feeling the threat of, ‘does this mean we will have no jobs?’ We went and said customers want more digital; we’ve got to train them on this. How will we go about it?”

Nurture capability for change: Invest in your people, from the transformation team to the front line

Just as governments need to invest in their leaders’ transformation skills, they must build capabilities for change across the organization—from the team tasked with managing the transformation program right through to the front line. MCG’s research shows that capability-building programs designed to help employees meet transformation goals more than triple the success rate of public-sector change initiatives.

So what kinds of capability programs are required? Certainly not the training in the policy and diplomacy skills classically emphasized in government. Rather, capability building is needed in a new generation of skills in operational delivery, analytics, change management, and communications (Exhibit 4). These new skills require new investment—which might mean that governments need to reverse the trend of declining public spending on labor-force training and support that has been observed in most Organisation for Economic Co-operation and Development (OECD) countries over the past 20 years.¹ Governments will also need to reallocate training budgets from compliance-based training to programs that nurture the skills that are critical to support transformation. In Ireland, for example, government leaders have explicitly committed more time and resources to training: they have increased the government’s learning-and-development budget to more than 3 percent of payroll, with a focus on critical skills such as digital capabilities.

Exhibit 4

But public-sector leaders need to do much more than shift training budgets: they need to shift cultures. One leader we interviewed spoke for many of his public-sector peers when he said, “I’ve spent my life not developing these skills. In fact, I have been advised against taking roles [that] focus on these, as they are less highly valued.”
Moreover, as we noted previously, public-sector organizations typically need to prioritize capability building more than their private-sector counterparts, as employee development and coaching in government has generally been less robust. For example, a McKinsey survey found that just 28 percent of public-sector managers were trained in supporting employees’ development, compared with 41 percent of managers across all sectors. Likewise, as Exhibit 3 shows, public-sector managers were much less likely to be trained in giving employees feedback.
Beyond these broader steps in capability building, governments must also home in on the teams tasked with managing the transformation effort. It’s critical to ensure that these teams are staffed with high-potential employees with clearly defined roles and responsibilities—and that the employees are trained effectively to deliver on those responsibilities (Exhibit 5). When governments get that right, they can double the success rate of large-scale change efforts.

Exhibit 5

All around the world, governments and public-sector agencies face an urgent imperative to deliver better outcomes, improve citizens’ experience of public services, and make constrained budgets go further. Achieving these results calls for ambitious, large-scale transformation. To get major change programs right, however, governments need to focus relentlessly on the three Ps: people, people, and people. They need to understand and tackle the cultural factors that hold back change, build change-leadership skills and mind-sets among senior managers, and nurture new capabilities right across their organizations.

Article link: https://www.mckinsey.com/industries/public-sector/our-insights/putting-people-at-the-heart-of-public-sector-transformations

WASHINGTON — When it comes to building teams, few people have more experience than Retired Gen. Martin E. Dempsey. Across his 41-year career, which culminated with being the 18th chairman of the Joint Chiefs of Staff, Gen. Dempsey was known as a Soldier’s Soldier and was revered by those he led. A graduate of the U.S. Military Academy, he also served as the 37th chief of staff of the Army and as commander of both Training and Doctrine Command and U.S. Central Command. We sat down with him to discuss his take on building the Army team for the future.

Q: You held many key leadership positions throughout your career. What were some of the lessons you learned about building successful teams?

A: For leaders at every level, from the lowest tactical level all the way up through the Army’s senior leadership, I think the best approach is to first think about how you influence before exerting your authority. To me, the best kind of leadership establishes a sense of belonging, makes clear that everyone’s contribution matters, and creates an environment where people get the job done because the leader has been persuasive with them.

The way you create high performing organizations that are cohesive and collaborative is by thinking about leadership as influence rather than authority. As soon as you have to exert authority, your leadership has become directive and the team responds differently.

There are obviously times when you have to exert your authority because there’s inadequate time to be influential and persuasive. But in the normal course of events, if you are a leader who believes in getting things done through influence, you’ll build the kind of trust that will allow the unit to respond positively when you do have to exert authority.

Q: How would you describe your leadership philosophy?

A: In the kind of leadership environment we live in, one with ubiquitous information, fragile facts, and intense scrutiny, the way to achieve trust within an organization is by being inclusive. I just coauthored a book, titled “Radical Inclusion,” because I believe this so strongly.

As we transitioned to an all-volunteer force, we made a commitment to ensure it would be reflective of the society it serves. That took us down a path of making sure we had a diverse group of leaders in the formations based on gender, ethnicity, and so forth. I think we really made impressive progress.

But let me make a distinction here. The kind of thing we’re talking about is beyond simple diversity. It’s not just taking stock of whether you have the proper representation of ethnic groups or genders, but, rather, we should be focusing on how inclusive we are. If you’re inclusive, the organization will naturally feel like it is contributing and bringing meaning, not just being dragged around by leadership.

Q: Can you discuss the importance of responsibility as it relates to maximizing team performance and realizing potential?

A: Responsibility is one of the principles of our profession; leaders accept responsibility for outcomes. This means they don’t just simply pass the buck. At every level, leaders need to hold themselves accountable for what they can, and should, accomplish at their particular level, whether it’s something as mundane as maintenance rates or something as abstract as building the Iraqi army. When they don’t have what they need to do so, they have an obligation to make sure the chain of command is informed.

The military can sometimes be criticized for its “can do” attitude. You’ve probably never met an officer who would say, “No, I can’t do that.” But we actually have a responsibility to explain both what we can do and what we can’t. That responsibility is at every level of the organization.

Of all the jobs I had in my career, the one with the least authority was actually when I was chairman of the Joint Chiefs of Staff. All the budgetary authority flows through the service chiefs; all the operational authority flows through the combatant commanders and up through the secretary of defense and the president. So the chairman’s role in some ways is to balance the supply and demand aspects of the force to meet the demands of the combatant commanders to the greatest extent possible, while making sure the service chiefs have the ability to develop forces ready to carry out the combatant commanders’ intent.

But that’s where responsibility comes in. It would be irresponsible to allow that relationship to become out of balance. If we constantly consume the force as it becomes ready, it makes it almost impossible for the service chiefs to organize, train, and equip the force as well as educate it on the responsibilities of the profession, its role in society, and its relationship with the American people. It is the chairman’s primary responsibility to keep all of that in balance.

Q: How important is sustainment to our operations, and how did you ensure our logisticians were integrated into the joint and coalition teams?

A: Absolutely vital. A famous logistician back in the Desert Storm era made the apropos comment that logisticians draw a line in the sand beyond which the operators dare not tread. His point was, generally speaking, logistics will determine the capability, speed, and tempo of operations. While that quote was very famous back in the 1990s, I had a much different view. I felt it was a bit pejorative and negative, suggestive that the logisticians were a limiting factor of what we could do. Throughout my entire career, I instead preferred to look at sustainment and logistics as enabling factors.

To ensure they’re integrated into the team, you have to include them at every point in the planning, preparation, and execution of the mission. As a battalion and regimental commander, I never allowed my staff to concoct an operations plan, get my approval on it, and then toss it over the transom to the logisticians and say, “Figure out how you’re going to support this.” Sustainers had to be on the team from the start so we had diverse thinking about these complex challenges.

I personally think that’s even more important today. The problems we face are so much more complex, especially in deployments, both the kind we’ve already fought and the ones we prepare for but have not had to perform yet, such as establishing a base of operation in Europe. That was one of the things I worried about most as chairman.

We had become exclusively capable at the kind of missions we were running in Iraq and Afghanistan but had let some of our expertise in other areas erode, things like the value and importance of deterrence, the ability to set a theater, and the ability to maneuver over distance with a heavy force and ensure all the enablers could move at the same pace. I think the expertise is starting to be regenerated, but we can never take those things for granted. Those who sustain and those who are storming the hill better be involved in the planning and preparation from the beginning, or in execution it’ll fail.

Q: Can you discuss the role our military spouses and Families play in the success of our total Army?

A: In 2003, I was commander of the 1st Armored Division and was given responsibility for Baghdad. Our mission statement for Task Force Iron was to establish a safe and secure environment in which the duly-appointed government of Iraq could restore basic services and security. We were spread out all over the place with more than 50 combat outposts and forward operating bases, and I had 32,000 Soldiers.

As I told my junior leaders, one of the things we learned very quickly was that contrary to other wars, we really took our Families with us when we deployed. They all looked at me like I had lost my mind, but my point was that we now had Soldiers either texting, Skyping or FaceTiming with their Families all the time. It was, “Oh by the way, I have to go now because I’ve got to take a convoy out; I’ll text or come back up on Skype when I get back.” So family members now had a real-time sense of anxiety about the well-being of their Soldiers.

It was interesting back in those days to try to exert some control over that. Finally, I came to the conclusion — and this gets back to the idea of radical inclusion — that the answer wasn’t to try to control it because it became nearly impossible. Even if you thought you could, you couldn’t. Instead, we actually tried to empower it and to literally make the family members feel like part of the team by sharing information with them about what we were doing and why. It became a very powerful leadership tool.

Initially, we thought the division was going home by Christmas of 2003. That was extended to April, which brought us to one full year, and then we were extended again to July following the Shiite rise. The way we got through that was making sure Soldiers and their Families concurrently understood what was happening and why.

I sent Mark Hertling, a brigadier general at the time, back to Europe, where we were mostly based, to partner with my wife, the U.S. Army Europe commander, and the European installation management director. Together they went from kaserne to kaserne doing hour-and-a-half briefings and taking another hour’s worth of questions so Families understood why our mission was important. Those Families then became part of the solution, not part of the problem.

As a commander at any level, if you think you can just worry about those who wear the uniform, it’s a big mistake.

Q: What was the most challenging team-building experience you had?

A: The most challenging experiences are generally those where units come together on relatively short notice, as we experienced in particular during the first decade of this century with things like the surge in Iraq. Everyone in the Army at the time was trying to figure out how we could more quickly adapt and innovate and how we could become more agile. One of the answers that emerged was modularity.

As we began to go down that path, phrases like “plug and play” came into play. We would take brigade combat teams from various divisions, run them through a mission readiness exercise, and then deploy them. But the cost of this model in terms of team building was pretty high.

Throughout the first 20 or 30 years of my career, I belonged to units that trained together habitually. We were task-organized habitually; we always knew which tank company would go over to the Infantry brigade or which Infantry battalion would come over to the Armor brigade, and we trained that way year-round. We got to know each other; our Families got to know each other. When you have that kind of constant interaction, it builds a bond of trust that runs pretty deep.

Modularity, of course, is kind of the antithesis of that. People come and go based on the needs of a particular mission. It’s the ultimate exercise in task organization. That’s difficult because systems or units only become high-performing when they begin to trust each other, not before. As an Army, I think we have to constantly be conscious of this balance between agility that comes through modularity and the bonding that comes through continuity.

Q: Since retiring from service, has your outlook on leadership evolved?

A: If anything, my beliefs about leadership based on my experiences coming through the ranks have actually been reinforced, especially this idea of trust being the cornerstone of building teams. In today’s environment, political corrosiveness has caused having a pleasant conversation about issues, which was always challenging, to become seemingly impossible. We often talk less about the substantive issues than we do about the narrative that accompanies them. It’s a battle of competing narratives more than a battle of merit on a particular issue. In that environment, it makes leading more difficult. Fortunately, however, it doesn’t make it impossible.

What makes it possible is a commitment to creating a sense of belonging, to make sure people know their contributions matter, and to develop trust. That was how I tried to lead throughout my career, particularly as a general officer where all of the sudden I had influence on the future of the Army and joint force. I’m sure there were individual actions along the way that I would’ve liked to have come out differently, but in terms of how I tried to build teams, I don’t think I would’ve done anything differently.

Q: What is the most important thing a young Soldier should know as part of the larger Army team?

A: The best young leaders, be they enlisted, warrant officers, or commissioned officers, have always had a sense that they were part of something bigger than themselves. I personally believe one of the things that makes the Army special is this ability to recognize the greater good we serve, and that’s probably even more true today in the current environment.

It doesn’t come to life immediately when a young man or woman raises their hand and takes the oath. But if leaders feel that responsibility to continue to educate the force that this is a team of teams, I think we’re going to be okay. We can’t forget we are one joint force, and it’s the American people who are counting on us. If we stay true to our professional ethos, we will succeed.

——————–
Arpi Dilanian is a strategic analyst in the Army G-4’s Logistics Initiatives Group. She holds a bachelor’s degree from American University and a master’s degree from Rensselaer Polytechnic Institute.

Matthew Howard is a strategic analyst in the Army G-4’s Logistics Initiatives Group. He holds bachelor’s and master’s degrees from Georgetown University.
——————–
This article was published in the November-December 2018 issue of Army Sustainment.

Article link: https://www.army.mil/article/213079/radical_inclusion_an_interview_with_retired_gen_martin_dempsey

Top Federal Bureau of Investigation official calls for greater public-private partnership to fight back increasingly sophisticated adversaries and attacks.

By Tom SullivanMarch 05, 201904:21 PM

SAN FRANCISCO — Christopher Wray, the director of the U.S. Federal Bureau of Investigation, struck a cautious tone on Tuesday morning here at RSA 2019 and he called for more cooperation to tackle the cybersecurity problem.

“Today’s cyberthreat is bigger than any one government agency — in fact it’s bigger than the government itself,” Wray said. “The scope, breadth, depth, sophistication and diversity of the threat we face now is unlike anything we’ve had in our lifetimes.”

Wray pointed to multinationals, criminal organizations, hacktavists, insider threats, China and North Korea all as among the most pressing issues as well as the blended threat of foreign intelligence units enlisting the help of hackers.

He said that cyber, perhaps more than any other area, is where public-private cooperation is needed for everyone’s sake.

“The key is having the private sector start to form relationships with field offices because it’s not just prevention but in many cases it’s mitigation and that’s where speed really matters,” Wray explained. Having an existing relationship, in turn, will help with that speed.

Brookings Institution Senior Fellow Susan Hennessey pressed Wray on the thorny issue of cooperating with the FBI in the wake of its incident with Apple. After Apple refused to grant the FBI access to San Bernandino shooter Syed Rizwan Farook’s iPhone in 2015 and the Bureau reportedly worked with a third-party to crack the phone anyway — a move that experts said demonstrated that even encrypted data is not entirely safe from nefarious actors.

“We are not trying to weaken encryption or find back doors. This is an issue getting worse and worse all the time,” Wray said. “It can’t be a sustainable end state that there is a space beyond our access for criminals to hide. I would love to see people come together and try to work toward solutions.”

The threats are not going to get easier or more simplistic.

Cisco Talos VP Matt Watchinski, for instance, said that as our world continues changing, technologies being invented today, including critical infrastructure, will challenge security professionals to keep getting better at what they do.

“At the end of the day,” FBI’s Wray said, “we need each other in a way that is becoming more and more apparent every day.”

Twitter: @SullyHIT
Email the writer: tom.sullivan@himssmedia.com

Article link: https://www.healthcareitnews.com/news/rsa-2019-fbi-director-christopher-wray-says-today’s-cybersecurity-threat-bigger-government

The malware made it possible to take over these systems remotely. Had the intruders disabled or tampered with them, and then used other software to make equipment at the plant malfunction, the consequences could have been catastrophic. Fortunately, a flaw in the code gave the hackers away before they could do any harm. It triggered a response from a safety system in June 2017, which brought the plant to a halt. Then in August, several more systems were tripped, causing another shutdown.

The first outage was mistakenly attributed to a mechanical glitch; after the second, the plant’s owners called in investigators. The sleuths found the malware, which has since been dubbed “Triton” (or sometimes “Trisis”) for the Triconex safety controller model that it targeted, which is made by Schneider Electric, a French company.

In a worst-case scenario, the rogue code could have led to the release of toxic hydrogen sulfide gas or caused explosions, putting lives at risk both at the facility and in the surrounding area.

Gutmanis recalls that dealing with the malware at the petrochemical plant, which had been restarted after the second incident, was a nerve-racking experience. “We knew that we couldn’t rely on the integrity of the safety systems,” he says. “It was about as bad as it could get.”

In attacking the plant, the hackers crossed a terrifying Rubicon. This was the first time the cybersecurity world had seen code deliberately designed to put lives at risk. Safety instrumented systems aren’t just found in petrochemical plants; they’re also the last line of defense in everything from transportation systems to water treatment facilities to nuclear power stations.

Triton’s discovery raises questions about how the hackers were able to get into these critical systems. It also comes at a time when industrial facilities are embedding connectivity in all kinds of equipment—a phenomenon known as the industrial internet of things. This connectivity lets workers remotely monitor equipment and rapidly gather data so they can make operations more efficient, but it also gives hackers more potential targets.

Those behind Triton are now on the hunt for new victims. Dragos, a firm that specializes in industrial cybersecurity, and where Gutmanis now works, says it’s seen evidence over the past year or so that the hacking group that built the malware and inserted it into the Saudi plant is using some of the same digital tradecraft to research targets in places outside the Middle East, including North America. And it’s creating new strains of the code in order to compromise a broader range of safety instrumented systems.

Red alert

News of Triton’s existence was revealed in December 2017, though the identity of the plant’s owner has been kept secret. (Gutmanis and other experts involved in the initial investigation decline to name the company because they fear doing so might dissuade future targets from sharing information about cyberattacks privately with security researchers.)

Over the past couple of years, cybersecurity firms have been racing to deconstruct the malware—and to work out who’s behind it. Their research paints a worrying picture of a sophisticated cyberweapon built and deployed by a determined and patient hacking group whose identity has yet to be established with certainty.

The hackers appear to have been inside the petrochemical company’s corporate IT network since 2014. From there, they eventually found a way into the plant’s own network, most likely through a hole in a poorly configured digital firewall that was supposed to stop unauthorized access. They then got into an engineering workstation, either by exploiting an unpatched flaw in its Windows code or by intercepting an employee’s login credentials.

Since the workstation communicated with the plant’s safety instrumented systems, the hackers were able to learn the make and model of the systems’ hardware controllers, as well as the versions of their firmware—software that’s embedded in a device’s memory and governs how it communicates with other things.

It’s likely they next acquired an identical Schneider machine and used it to test the malware they developed. This made it possible to mimic the protocol, or set of digital rules, that the engineering workstation used to communicate with the safety systems. The hackers also found a “zero-day vulnerability”, or previously unknown bug, in the Triconex model’s firmware. This let them inject code into the safety systems’ memories that ensured they could access the controllers whenever they wanted to.

Thus, the intruders could have ordered the safety instrumented systems to disable themselves and then used other malware to trigger an unsafe situation at the plant.

The results could have been horrific. The world’s worst industrial disaster to date also involved a leak of poisonous gases. In December 1984 a Union Carbide pesticide plant in Bhopal, India, released a vast cloud of toxic fumes, killing thousands and causing severe injuries to many more. The cause that time was poor maintenance and human error. But malfunctioning and inoperable safety systems at the plant meant that its last line of defense failed.

More red alerts

There have been only a few previous examples of hackers using cyberspace to try to disrupt the physical world. They include Stuxnet, which caused hundreds of centrifuges at an Iranian nuclear plant to spin out of control and destroy themselves in 2010, and CrashOverride, which Russian hackers used in 2016 to strike at Ukraine’s power grid. (Our sidebar provides a summary of these and other notable cyber-physical attacks.)

However, not even the most pessimistic of cyber-Cassandras saw malware like Triton coming. “Targeting safety systems just seemed to be off limits morally and really hard to do technically,” explains Joe Slowik, a former information warfare officer in the US Navy, who also works at Dragos.

Other experts were also shocked when they saw news of the killer code. “Even with Stuxnet and other malware, there was never a blatant, flat-out intent to hurt people,” says Bradford Hegrat, a consultant at Accenture who specializes in industrial cybersecurity.

It’s almost certainly no coincidence that the malware appeared just as hackers from countries like Russia, Iran, and North Korea stepped up their probing of “critical infrastructure” sectors vital to the smooth running of modern economies, such as oil and gas companies, electrical utilities, and transport networks.

In a speech last year, Dan Coats, the US director of national intelligence, warned that the danger of a crippling cyberattack on critical American infrastructure was growing. He drew a parallel with the increased cyber chatter US intelligence agencies detected among terrorist groups before the World Trade Center attack in 2001. “Here we are nearly two decades later, and I’m here to say the warning lights are blinking red again,” said Coats. “Today, the digital infrastructure that serves this country is literally under attack.”

At first, Triton was widely thought to be the work of Iran, given that it and Saudi Arabia are archenemies. But cyber-whodunnits are rarely straightforward. In a report published last October, FireEye, a cybersecurity firm that was called in at the very beginning of the Triton investigation, fingered a different culprit: Russia.

The hackers behind Triton had tested elements of the code used during the intrusion to make it harder for antivirus programs to detect. FireEye’s researchers found a digital file they had left behind on the petrochemical company’s network, and they were then able to track down other files from the same test bed. These contained several names in Cyrillic characters, as well as an IP address that had been used to launch operations linked to the malware.

That address was registered to the Central Scientific Research Institute of Chemistry and Mechanics in Moscow, a government-owned organization with divisions that focus on critical infrastructure and industrial safety. FireEye also said it had found evidence that pointed to the involvement of a professor at the institute, though it didn’t name the person. Nevertheless, the report noted that FireEye hadn’t found specific evidence proving definitively that the institute had developed Triton.

Researchers are still digging into the malware’s origins, so more theories about who’s behind it may yet emerge. Gutmanis, meanwhile, is keen to help companies learn important lessons from his experience at the Saudi plant. In a presentation at the S4X19 industrial security conference in January, he outlined a number of them. They included the fact that the victim of the Triton attack had ignored multiple antivirus alarms triggered by the malware, and that it had failed to spot some unusual traffic across its networks. Workers at the plant had also left physical keys that control settings on Triconex systems in a position that allowed the machines’ software to be accessed remotely.

If that makes the Saudi business sound like a security basket case, Gutmanis says it isn’t. “I’ve been into a lot of plants in the US that were nowhere near as mature [in their approach to cybersecurity] as this organization was,” he explains.

Other experts note that Triton shows government hackers are now willing to go after even relatively obscure and hard-to-crack targets in industrial facilities. Safety instrumented systems are highly tailored to safeguard different kinds of processes, so crafting malware to control them involves a great deal of time and painstaking effort. Schneider Electric’s Triconex controller, for instance, comes in dozens of different models, and each of these could be loaded with different versions of firmware.

That hackers went to such great lengths to develop Triton has been a wake-up call for Schneider and other makers of safety instrumented systems—companies like Emerson in the US and Yokogawa in Japan. Schneider has drawn praise for publicly sharing details of how the hackers targeted its Triconex model at the Saudi plant, including highlighting the zero-day bug that has since been patched. But during his January presentation, Gutmanis criticized the firm for failing to communicate enough with investigators in the immediate aftermath of the attack.

Schneider responded by saying it had cooperated fully with the company whose plant was targeted, as well as with the US Department of Homeland Security and other agencies involved in investigating Triton. It has hired more people since the event to help it respond to future incidents, and has also beefed up the security of the firmware and protocols used in its devices.

Andrew Kling, a Schneider executive, says an important lesson from Triton’s discovery is that industrial companies and equipment manufacturers need to focus even more on areas that may seem like highly unlikely targets for hackers but could cause disaster if compromised. These include things like software applications that are rarely used and older protocols that govern machine-to-machine communication. “You may think nobody’s ever going to bother breaking [an] obscure protocol that’s not even documented,” Kling says, “but you need to ask, what are the consequences if they do?”

An analog future?

Over the past decade or so, companies have been adding internet connectivity and sensors to all kinds of industrial equipment. The data captured is being used for everything from predictive maintenance—which means using machine-learning models to better anticipate when equipment needs servicing—to fine-tuning production processes. There’s also been a big push to control processes remotely through things like smartphones and tablets.

All this can make businesses much more efficient and productive, which explains why they are expected to spend around $42 billion this year on industrial internet gear such as smart sensors and automated control systems, according to the ARC Group, which tracks the market. But the risks are also clear: the more connected equipment there is, the more targets hackers have to aim at.

To keep attackers out, industrial companies typically rely on a strategy known as “defense in depth.” This means creating multiple layers of security, starting with firewalls to separate corporate networks from the internet. Other layers are intended to prevent hackers who do get in from accessing plant networks and then industrial control systems.

These defenses also include things like antivirus tools to spot malware and, increasingly, artificial-intelligence software that tries to spot anomalous behavior inside IT systems. Then, as the ultimate backstop, there are the safety instrumented systems and physical fail-safes. The most critical systems typically have multiple physical backups to guard against the failure of any one element.

The strategy has proved robust. But the rise of nation-state hackers with the time, money, and motivation to target critical infrastructure, as well as the increasing use of internet-connected systems, means the past may well not be a reliable guide to the future.

Russia, in particular, has shown that it’s willing to weaponize software and deploy it against physical targets in Ukraine, which it has used as a testing ground for its cyber arms kit. And Triton’s deployment in Saudi Arabia shows that determined hackers will spend years of prodding and probing to find ways to drill through all those defensive layers.

Fortunately, the Saudi plant’s attackers were intercepted, and we now know a great deal more about how they worked. But it’s a sobering reminder that, just like other developers, hackers make mistakes too. What if the bug they inadvertently introduced, instead of triggering a safe shutdown, had disabled the plant’s safety systems just when a human error or other mistake had caused one of the critical processes in the plant to go haywire? The result could have been a catastrophe even if the hackers hadn’t intended to cause it.

Experts at places like the US’s Idaho National Laboratory are urging companies to revisit all their operations in the light of Triton and other cyber-physical threats, and to radically reduce, or eliminate, the digital pathways hackers could use to get to critical processes.

Businesses may chafe at the costs of doing that, but Triton is a reminder that the risks are increasing. Gutmanis thinks more attacks using the world’s most murderous malware are all but inevitable. “While this was the first,” he says, “I’d be surprised if it turns out to be the last.”

Article link: https://www.technologyreview.com/s/613054/cybersecurity-critical-infrastructure-triton-malware/amp/

The Defense Health Agency joins a growing list of defense agencies moving their data to the commercial cloud

The Defense Health Agency, which supports the delivery of health and medical services to millions of Army, Navy and Air Force personnel worldwide, is Amazon’s newest cloud customer.

Amazon Web Services will now host DHA’s Armed Forces Billing and Collection Utilization Solution in GovCloud U.S. West region, a cluster of data centers built specifically to host some of the government’s most sensitive data.

DHA joins the Army, U.S. Transportation Command and other defense agencies moving increasingly large—and sometimes highly sensitive—data sets to commercial clouds.

The cloud migration, executed by Virginia-based defense and technology contractor General Dynamics Information Technology, marks the first time DHA has migrated an Impact Level 4 workload—which includes sensitive unclassified data—to AWS.

“GDIT has reached a significant milestone by successfully navigating DHA’s workload to AWS GovCloud (US-West) Region,” said vice president Kamal Narang, head of GDIT’s Health Sector. “Our strong relationship with AWS and intimate knowledge of our customer’s needs made this challenge a reality and will usher in a new era of cloud agility for DHA.”

GDIT will continue its relationship with DHA following a $56 million, five-year task order awarded by the agency to operate and sustain the cloud-based Armed Forces Billing and Collection Utilization Solution.

The move to cloud reflects a growing trend within the Pentagon and across civilian agencies. Some analysts predict the Defense Department will spend as much as $2 billion in cloud-related services in the coming year. The Pentagon is also expected to award two cloud contracts—the Defense Enterprise Office Solutions and Joint Enterprise Defense Infrastructure contracts—potentially worth a total of $18 billion.

Article link: https://www.nextgov.com/it-modernization/2019/03/another-defense-agency-migrates-data-amazon-cloud/155699/

By Michael Chui, Nicolaus Henke, and Mehdi Miremadi

An examination of more than 400 AI use cases revealed the two areas where AI can have the greatest impact, write the authors in Harvard Business Review.

While overall adoption of artificial intelligence (AI) remains low among businesses (about 20 percent upon our last study), senior executives know that AI isn’t just hype. Organizations across sectors are looking closely at the technology to see what it can do for their business. As they should—we estimate that 40 percent of all the potential value that can be created by analytics today comes from the AI techniques that fall under the umbrella “deep learning” (which utilize multiple layers of artificial neural networks, so-called because their structure and function are loosely inspired by that of the human brain). In total, we estimate deep learning could account for between $3.5 trillion and $5.8 trillion in annual value.
However, many business leaders are still not exactly sure where they should apply AI to reap the biggest rewards. After all, embedding AI across the business requires significant investment in talent and upgrades to the tech stack as well as sweeping change initiatives to ensure AI drives meaningful value, whether it be through powering better decision making or enhancing consumer-facing applications.
Through an in-depth examination of more than 400 actual AI use cases across 19 industries and nine business functions, we’ve discovered an old adage proves most useful in answering the question of where to put AI to work: “Follow the money.”
The business areas that traditionally provide the most value to companies tend to be the areas where AI can have the biggest impact. In retail organizations, for example, marketing and sales has often provided significant value. Our research shows that using AI on customer data to personalize promotions can lead to a 1 to 2 percent increase in incremental sales for brick-and-mortar retailers alone. In advanced manufacturing, by contrast, operations often drive the most value. Here, AI can enable forecasting based on underlying causal drivers of demand rather than prior outcomes, improving forecasting accuracy by 10 to 20 percent. This translates into a potential 5 percent reduction in inventory costs and revenue increases of 2 to 3 percent.

While applications of AI cover a full range of functional areas, it is in fact in these two cross-cutting ones—supply-chain management/manufacturing and marketing and sales—where we believe AI can have the biggest impact, at least for now, in several industries (exhibit). Combined, we estimate that these use cases make up more than two-thirds of the entire AI opportunity. AI can create $1.4 trillion to $2.6 trillion of value in marketing and sales across the world’s businesses, and $1.2 trillion to $2 trillion in supply-chain management and manufacturing (some of the value accrues to companies, while some is captured by customers). In manufacturing, the greatest value from AI can be created by using it for predictive maintenance (about $0.5 trillion to $0.7 trillion across the world’s businesses). AI’s ability to process massive amounts of data, including audio and video, means it can quickly identify anomalies to prevent breakdowns, whether that be an odd sound in an aircraft engine or a malfunction on an assembly line detected by a sensor.

Another way business leaders can home in on where to apply AI is to simply look at the functions that are already taking advantage of traditional analytics techniques. We found that the greatest potential for AI to create value is in use cases where neural network techniques could either provide higher performance than established analytical techniques or generate additional insights and applications. This is true for 69 percent of the AI use cases identified in our study. In only 16 percent of use cases did we find a “greenfield” AI solution that was applicable where other analytics methods would not be effective. (While the number of use cases for deep learning will likely increase rapidly as algorithms become more versatile and the type and volume of data needed to make them viable become more available, the percentage of greenfield deep learning use cases might not increase significantly, because more established machine learning techniques also have room to become better and more ubiquitous.)

The executive’s AI playbook

Explore the interactive

We don’t want to come across as naïve cheerleaders. Even as we see economic potential in the use of AI techniques, we recognize the tangible obstacles and limitations to implementing AI. Obtaining data sets that are sufficiently large and comprehensive enough to feed the voracious appetite that deep learning has for training data is a major challenge. So, too, is addressing the mounting concerns around the use of such data, including security, privacy, and the potential for passing human biases onto AI algorithms. In some sectors, such as healthcare and insurance, companies must also find ways to make the results explainable to regulators in human terms: why did the machine come up with this answer? The good news is that the technologies themselves are advancing and starting to address some of these limitations.

Beyond these limitations, there are the arguably more difficult organizational challenges companies face as they adopt AI. Mastering the technology requires new levels of expertise, and process can become a major impediment to successful adoption. Companies will have to develop robust data maintenance and governance processes and focus on both the “first mile”—how to acquire data and organize data efforts—and the far more difficult “last mile,” how to integrate the output of AI models into workflows, ranging from those of clinical-trial managers and sales-force managers to procurement officers.

While businesses must remain vigilant and responsible as they deploy AI, the scale and beneficial impact of the technology on businesses, consumers, and society make pursuing AI opportunities worth a thorough investigation. The pursuit isn’t a simple prospect, but it can be initiated by evoking a simple concept: follow the money.
This article originally appeared in Harvard Business Review in July 2018.

About the author(s)
Michael Chui is a partner of the McKinsey Global Institute and is based in McKinsey’s San Francisco office, Nicolaus Henke is a senior partner in the London office, and Mehdi Miremadi is a partner in the Chicago office.

Article link https://www.mckinsey.com/business-functions/mckinsey-analytics/our-insights/most-of-ais-business-uses-will-be-in-two-areas

By Lee J Miller and Wei Lu
February 24, 2019, 9:00 AM EST

• Iceland, Japan, Switzerland round out top five; U.S. is 35th
• Health index looks at life expectancy, environmental factors

Maybe it’s something in the gazpacho or paella, as Spain just surpassed Italy to become the world’s healthiest country.
That’s according to the 2019 edition of the Bloomberg Healthiest Country Index, which ranks 169 economies according to factors that contribute to overall health. Spain placed sixth in the previous gauge, published in 2017.

Four additional European nations were among the top 10 in 2019: Iceland (third place), Switzerland (fifth), Sweden (sixth) and Norway (ninth). Japan was the healthiest Asian nation, jumping three places from the 2017 survey into fourth and replacing Singapore, which dropped to eighth. Australia and Israel rounded out the top 10 at seventh and 10th place.

The index grades nations based on variables including life expectancy while imposing penalties on risks such as tobacco use and obesity. It also takes into consideration environmental factors including access to clean water and sanitation.
Spain has the highest life expectancy at birth among European Union nations, and trails only Japan and Switzerland globally, United Nations data show. Spain by 2040 is forecast to have the highest lifespan, at almost 86 years, followed by Japan, Singapore and Switzerland, according to the University of Washington’s Institute for Health Metrics and Evaluation.
“Primary care is essentially provided by public providers, specialized family doctors and staff nurses, who provide preventive services to children, women and elderly patients, and acute and chronic care,” according to the European Observatory on Health Systems and Policies 2018 review of Spain, noting a decline the past decade in cardiovascular diseases and deaths from cancer.

Researchers say eating habits may provide clues to health levels enjoyed by Spain and Italy, as a “Mediterranean diet, supplemented with extra-virgin olive oil or nuts, had a lower rate of major cardiovascular events than those assigned to a reduced-fat diet,” according to a study led by the University of Navarra Medical School.
Meanwhile in North America, Canada’s 16th-place ranking far surpassed the U.S. and Mexico, both of which dropped slightly to 35th and 53rd. Life expectancy in the U.S. has been trending lower due to deaths from drug overdoses and suicides.
Cuba placed five spots above the U.S., making it the only nation not classified as “high income” by the World Bank to be ranked that high. One reason for the island nation’s success may be its emphasis on preventative care over the U.S. focus on diagnosing and treating illness, the American Bar Association Health Law Section said in a report last year after vising Cuba.

South Korea improved seven spots to 17th while China, home to 1.4 billion people, rose three places to 52nd. Life expectancy in China is on track to surpass the U.S. by 2040, according to the Institute for Health Metrics and Evaluation.
Sub-Saharan economies accounted for 27 of the 30 unhealthiest nations in the ranking. Haiti, Afghanistan and Yemen were the others. Mauritius was the healthiest in Sub-Sahara, placing 74th globally as it had the lowest death rate by communicable diseases in a region still marred by infectious mortality.

Methodology

Bloomberg evaluated health variables and risks ranging from those of behavioral nature to environmental characteristics. Final index only included nations with at least 0.3 million population and sufficient data. 169 WHO states met the criteria to be included.

To access the Bloomberg 2019 Healthiest Country Index data set for all nations, click HERE.

Article link: https://www.bloomberg.com/amp/news/articles/2019-02-24/spain-tops-italy-as-world-s-healthiest-nation-while-u-s-slips

CMS Office of the Actuary Releases 2018-2027 Projections of National Health Expenditures

National health expenditure growth is expected to average 5.5 percent annually from 2018-2027, reaching nearly $6.0 trillion by 2027, according to a report published today by the independent Office of the Actuary at the Centers for Medicare & Medicaid Services (CMS). 

Growth in national health spending is projected to be faster than projected growth in Gross Domestic Product (GDP) by 0.8 percentage points over the same period.  As a result, the report projects the health share of GDP to rise from 17.9 percent in 2017 to 19.4 percent by 2027.

The outlook for national health spending and enrollment over the next decade is expected to be driven primarily by:

• Key economic factors, such as growth in income and employment, and demographic factors, such as the baby-boom generation continuing to age from private insurance into Medicare; and
• Increases in prices for medical goods and services (projected to grow 2.5 percent over 2018-2027 compared to 1.1 percent during the period of 2014-2017).

Similar to the findings in last year’s report, the report found that by 2027, federal, state and local governments are projected to finance 47 percent of national health spending, an increase of 2 percentage points from 45 percent in 2017.  As a result of comparatively higher projected enrollment growth in Medicare, average annual spending growth in Medicare (7.4 percent) is expected to exceed that of Medicaid (5.5 percent) and private health insurance (4.8 percent).

Selected highlights in projected health insurance enrollment and national health expenditures by sector and payer include:

Health Insurance Enrollment: Net enrollment gains across all sources are generally expected to keep pace with population growth with the insured share of the population going from 90.9 percent in 2017 to 89.7 percent in 2027.

Medicare: Medicare spending growth is projected to average 7.4 percent over 2018-2027, the fastest rate among the major payers.  Underlying the strong average annual Medicare spending growth are projected sustained strong enrollment growth as the baby-boomers continue to age into the program and growth in the use and intensity of covered services that is consistent with the rates observed during Medicare’s long-term history.

Medicaid: Average annual growth of 5.5 percent is projected for Medicaid spending for 2018-2027.  Medicaid expansions during 2019 in Idaho, Maine, Nebraska, Utah, and Virginia are expected to result in the first acceleration in growth in spending for the program since 2014 (from 2.2 percent in 2018 to 4.8 percent in 2019).  Medicaid spending growth is then projected to average 6.0 percent for 2020 through 2027 as the program’s spending patterns reflect an enrollment mix more heavily influenced by comparatively more expensive aged and disabled enrollees.

Private Health Insurance and Out-of-Pocket: For 2018-2027, private health insurance spending growth is projected to average 4.8 percent, slowest among the major payers, which is partly due to slow enrollment growth related to the baby-boomers transitioning from private coverage into Medicare.  Out-of-pocket expenditures are also projected to grow at an average rate of 4.8 percent over 2018-2027 and to represent 9.8 percent of total spending by 2027 (down from 10.5 percent in 2017).

Prescription Drugs:  Spending growth for prescription drugs is projected to generally accelerate over 2018-2027 (and average 5.6 percent) mostly as a result of faster utilization growth.  Underlying faster growth in the utilization of prescription drugs, particularly over 2020-2027, are a number of factors including efforts on the part of employers and insurers to encourage better medication adherence among those with chronic conditions, changing pharmacotherapy guidelines, faster projected private health insurance spending growth in lagged response to higher income growth, and an expected influx of new and expensive innovative drugs into the market towards the latter stage of the period.

Hospital:  Hospital spending growth is projected to average 5.6 percent for 2018-2027. This includes a projected acceleration in 2019, to 5.1 percent from 4.4 percent in 2018, reflecting the net result of faster expected growth in both Medicare (higher payment updates) and Medicaid (as a result of expansion in five states), but slower projected growth in private health insurance as enrollment declines slightly due to the repeal of the individual mandate.

Physician and Clinical Services: Physician and clinical services spending is projected to grow an average of 5.4 percent per year over 2018-2027.  This includes faster growth in prices over 2020-2027 for physician and clinical services due to anticipated rising wage growth related to increased demand from the aging population.

The Office of the Actuary’s report will appear at: http://www.cms.gov/Research-Statistics-Data-and-Systems/Statistics-Trends-and-Reports/NationalHealthExpendData/NationalHealthAccountsProjected.html
An article about the study is also being published by Health Affairs and is available here: https://protect2.fireeye.com/url?k=529199bd-0ec4906d-5291a882-0cc47a6a52de-97641bdac742d461&u=http://www.healthaffairs.org/doi/abs/10.1377/hlthaff.2018.05499

Article link: https://www.cms.gov/newsroom/press-releases/cms-office-actuary-releases-2018-2027-projections-national-health-expenditures

Get CMS news at cms.gov/newsroom, sign up for CMS news via email and follow CMS on Twitter CMS Administrator @SeemaCMS, @CMSgov, and @CMSgovPress.

Researchers and companies are creating ultra-secure communication networks that could form the basis of a quantum internet. This is how it works.

• by Martin Giles
• February 14, 2019

Barely a week goes by without reports of some new mega-hack that’s exposed huge amounts of sensitive information, from people’s credit card details and health records to companies’ valuable intellectual property. The threat posed by cyberattacks is forcing governments, militaries, and businesses to explore more secure ways of transmitting information.

Today, sensitive data is typically encrypted and then sent across fiber-optic cables and other channels together with the digital “keys” needed to decode the information. The data and the keys are sent as classical bits—a stream of electrical or optical pulses representing 1s and 0s. And that makes them vulnerable. Smart hackers can read and copy bits in transit without leaving a trace.

Quantum communication takes advantage of the laws of quantum physics to protect data. These laws allow particles—typically photons of light for transmitting data along optical cables—to take on a state of superposition, which means they can represent multiple combinations of 1 and 0 simultaneously. The particles are known as quantum bits, or qubits.

The beauty of qubits from a cybersecurity perspective is that if a hacker tries to observe them in transit, their super-fragile quantum state “collapses” to either 1 or 0. This means a hacker can’t tamper with the qubits without leaving behind a telltale sign of the activity.

Some companies have taken advantage of this property to create networks for transmitting highly sensitive data based on a process called quantum key distribution, or QKD. In theory, at least, these networks are ultra-secure.

What is quantum key distribution?

QKD involves sending encrypted data as classical bits over networks, while the keys to decrypt the information are encoded and transmitted in a quantum state using qubits.

Various approaches, or protocols, have been developed for implementing QKD. A widely used one known as BB84 works like this. Imagine two people, Alice and Bob. Alice wants to send data securely to Bob. To do so, she creates an encryption key in the form of qubits whose polarization states represent the individual bit values of the key.

The qubits can be sent to Bob through a fiber-optic cable. By comparing measurements of the state of a fraction of these qubits—a process known as “key sifting”—Alice and Bob can establish that they hold the same key.

As the qubits travel to their destination, the fragile quantum state of some of them will collapse because of decoherence. To account for this, Alice and Bob next run through a process known as “key distillation,” which involves calculating whether the error rate is high enough to suggest that a hacker has tried to intercept the key.

If it is, they ditch the suspect key and keep generating new ones until they are confident that they share a secure key. Alice can then use hers to encrypt data and send it in classical bits to Bob, who uses his key to decode the information.

We’re already starting to see more QKD networks emerge. The longest is in China, which boasts a 2,032-kilometer (1,263-mile) ground link between Beijing and Shanghai. Banks and other financial companies are already using it to transmit data. In the US, a startup called Quantum Xchange has struck a deal giving it access to 500 miles (805 kilometers) of fiber-optic cable running along the East Coast to create a QKD network. The initial leg will link Manhattan with New Jersey, where many banks have large data centers.

Although QKD is relatively secure, it would be even safer if it could count on quantum repeaters.

What is a quantum repeater?

Materials in cables can absorb photons, which means they can typically travel for no more than a few tens of kilometers. In a classical network, repeaters at various points along a cable are used to amplify the signal to compensate for this.

QKD networks have come up with a similar solution, creating “trusted nodes” at various points. The Beijing-to-Shanghai network has 32 of them, for instance. At these waystations, quantum keys are decrypted into bits and then reencrypted in a fresh quantum state for their journey to the next node. But this means trusted nodes can’t really be trusted: a hacker who breached the nodes’ security could copy the bits undetected and thus acquire a key, as could a company or government running the nodes.

Ideally, we need quantum repeaters, or waystations with quantum processors in them that would allow encryption keys to remain in quantum form as they are amplified and sent over long distances. Researchers have demonstrated it’s possible in principle to build such repeaters, but they haven’t yet been able to produce a working prototype.

There’s another issue with QKD. The underlying data is still transmitted as encrypted bits across conventional networks. This means a hacker who breached a network’s defenses could copy the bits undetected, and then use powerful computers to try to crack the key used to encrypt them.

The most powerful encryption algorithms are pretty robust, but the risk is big enough to spur some researchers to work on an alternative approach known as quantum teleportation.

What is quantum teleportation?

This may sound like science fiction, but it’s a real method that involves transmitting data wholly in quantum form. The approach relies on a quantum phenomenon known as entanglement.

Quantum teleportation works by creating pairs of entangled photons and then sending one of each pair to the sender of data and the other to a recipient. When Alice receives her entangled photon, she lets it interact with a “memory qubit” that holds the data she wants to transmit to Bob. This interaction changes the state of her photon, and because it is entangled with Bob’s, the interaction instantaneously changes the state of his photon too.

In effect, this “teleports” the data in Alice’s memory qubit from her photon to Bob’s. The graphic below lays out the process in a little more detail:

Researchers in the US, China, and Europe are racing to create teleportation networks capable of distributing entangled photons. But getting them to scale will be a massive scientific and engineering challenge. The many hurdles include finding reliable ways of churning out lots of linked photons on demand, and maintaining their entanglement over very long distances—something that quantum repeaters would make easier.

Still, these challenges haven’t stopped researchers from dreaming of a future quantum internet.

What is a quantum internet?

Just like the traditional internet, this would be a globe-spanning network of networks. The big difference is that the underlying communications networks would be quantum ones

It isn’t going to replace the internet as we know it today. Cat photos, music videos, and a great deal of non-sensitive business information will still move around in the form of classical bits. But a quantum internet will appeal to organizations that need to keep particularly valuable data secure. It could also be an ideal way to connect information flowing between quantum computers, which are increasingly being made available through the computing cloud.

China is in the vanguard of the push toward a quantum internet. It launched a dedicated quantum communications satellite called Micius a few years ago, and in 2017 the satellite helped stage the world’s first intercontinental, QKD-secured video conference, between Beijing and Vienna. A ground station already links the satellite to the Beijing-to-Shanghai terrestrial network. China plans to launch more quantum satellites, and several cities in the country are laying plans for municipal QKD networks.

Some researchers have warned that even a fully quantum internet may ultimately become vulnerable to new attacks that are themselves quantum based. But faced with the hacking onslaught that plagues today’s internet, businesses, governments, and the military are going to keep exploring the tantalizing prospect of a more secure quantum alternative.

Article link: https://www.technologyreview.com/s/612964/what-is-quantum-communications/

Martin GilesSan Francisco Bureau Chief

I am the San Francisco bureau chief of MIT Technology Review, where I cover the future of computing and the companies in Silicon Valley that are shaping it. Before joining the publication, I led research and publishing at a venture capital… More

Rebecca Linke

Sep 14, 2017

What is design thinking?

Design thinking is an innovative problem-solving process rooted in a set of skills.

The approach has been around for decades, but it only started gaining traction outside of the design community after the 2008 Harvard Business Review article[subscription required] titled “Design Thinking” by Tim Brown, CEO and president of design company IDEO.

Since then, the design thinking process has been applied to developing new products and services, and to a whole range of problems, from creating a business model for selling solar panels in Africa to the operation of Airbnb.

At a high level, the steps involved in the design thinking process are simple: first, fully understand the problem; second, explore a wide range of possible solutions; third, iterate extensively through prototyping and testing; and finally, implement through the customary deployment mechanisms.

The skills associated with these steps help people apply creativity to effectively solve real-world problems better than they otherwise would. They can be readily learned, but take effort. For instance, when trying to understand a problem, setting aside your own preconceptions is vital, but it’s hard. Creative brainstorming is necessary for developing possible solutions, but many people don’t do it particularly well. And throughout the process it is critical to engage in modeling, analysis, prototyping, and testing, and to really learn from these many iterations.

Once you master the skills central to the design thinking approach, they can be applied to solve problems in daily life and any industry.

Here’s what you need to know to get started.

Understand the problem 

The first step in design thinking is to understand the problem you are trying to solve before searching for solutions. Sometimes, the problem you need to address is not the one you originally set out to tackle.

“Most people don’t make much of an effort to explore the problem space before exploring the solution space,” said MIT Sloan professor Steve Eppinger. The mistake they make is to try and empathize, connecting the stated problem only to their own experiences. This falsely leads to the belief that you completely understand the situation. But the actual problem is always broader, more nuanced, or different than people originally assume.

Take the example of a meal delivery service in Holstebro, Denmark. When a team first began looking at the problem of poor nutrition and malnourishment among the elderly in the city, many of whom received meals from the service, it thought that simply updating the menu options would be a sufficient solution. But after closer observation, the team realized the scope of the problem was much larger, and that they would need to redesign the entire experience, not only for those receiving the meals, but for those preparing the meals as well. While the company changed almost everything about itself, including rebranding as The Good Kitchen, the most important change the company made when rethinking its business model was shifting how employees viewed themselves and their work. That, in turn, helped them create better meals (which were also drastically changed), yielding happier, better nourished customers.

Involve users

Imagine you are designing a new walker for rehabilitation patients and the elderly, but you have never used one. Could you fully understand what customers need? Certainly not, if you haven’t extensively observed and spoken with real customers. There is a reason that design thinking is often referred to as human-centered design.

“You have to immerse yourself in the problem,” Eppinger said.

How do you start to understand how to build a better walker? When a team from MIT’s Integrated Design and Management programtogether with the design firm Altitude took on that task, they met with walker users to interview them, observe them, and understand their experiences.

“We center the design process on human beings by understanding their needs at the beginning, and then include them throughout the development and testing process,” Eppinger said.

Central to the design thinking process is prototyping and testing (more on that later) which allows designers to try, to fail, and to learn what works. Testing also involves customers, and that continued involvement provides essential user feedback on potential designs and use cases. If the MIT-Altitude team studying walkers had ended user involvement after its initial interviews, it would likely have ended up with a walker that didn’t work very well for customers.

It is also important to interview and understand other stakeholders, like people selling the product, or those who are supporting the users throughout the product life cycle.

Go wild!

The second phase of design thinking is developing solutions to the problem (which you now fully understand). This begins with what most people know as brainstorming.

Hold nothing back during brainstorming sessions — except criticism. Infeasible ideas can generate useful solutions, but you’d never get there if you shoot down every impractical idea from the start.

“One of the key principles of brainstorming is to suspend judgment,” Eppinger said. “When we’re exploring the solution space, we first broaden the search and generate lots of possibilities, including the wild and crazy ideas. Of course, the only way we’re going to build on the wild and crazy ideas is if we consider them in the first place.”

That doesn’t mean you never judge the ideas, Eppinger said. That part comes later, in downselection. “But if we want 100 ideas to choose from, we can’t be very critical.”

In the case of The Good Kitchen, the kitchen employees were given new uniforms. Why? Uniforms don’t directly affect the competence of the cooks or the taste of the food.

But during interviews conducted with kitchen employees, designers realized that morale was low, in part because employees were bored preparing the same dishes over and over again, in part because they felt that others had a poor perception of them. The new, chef-style uniforms gave the cooks a greater sense of pride. It was only part of the solution, but if the idea had been rejected outright, or perhaps not even suggested, the company would have missed an important aspect of the solution.

Prototype and test. Repeat.

You’ve defined the problem. You’ve spoken to customers. You’ve brainstormed, come up with all sorts of ideas, and worked with your team to boil those ideas down to the ones you think may actually solve the problem you’ve defined.

What next?

“We don’t develop a good solution just by thinking about a list of ideas, bullet points and rough sketches,” Eppinger said. “We explore potential solutions through modeling and prototyping. We design, we build, we test, and repeat — this design iteration process is absolutely critical to effective design thinking.”

Repeating this loop of prototyping, testing, and gathering user feedback is crucial for making sure the design is right — that is, it works for customers, you can build it, and you can support it.

“After several iterations, we might get something that works, we validate it with real customers, and we often find that what we thought was a great solution is actually only just OK. But then we can make it a lot better through even just a few more iterations,” Eppinger said

Implementation

The goal of all the steps that come before this is to have the best possible solution before you move into implementing the design. Your team will spend most of its time, its money, and its energy on this stage.

“Implementation involves detailed design, training, tooling, and ramping up. It is a huge amount of effort, so get it right before you expend that effort,” said Eppinger.

Think big

Design thinking isn’t just for “things.” If you are only applying the approach to physical products, you aren’t getting the most out of it. Design thinking can be applied to any problem that needs a creative solution. When Eppinger ran into a primary school educator who told him design thinking was big in his school, Eppinger thought he meant that they were teaching students the tenets of design thinking.

“It turns out they meant they were using design thinking in running their operations and improving the school programs. It’s being applied everywhere these days,” Eppinger said.

In another example from the education field, Peruvian entrepreneur Carlos Rodriguez-Pastor hired design consulting firm IDEO to redesign every aspect of the learning experience in a network of schools in Peru. The ultimate goal? To elevate Peru’s middle class.

As you’d expect, many large corporations have also adopted design thinking. IBM has adopted it at a company-wide level, training many of its nearly 400,000 employees in design thinking principles.

What can design thinking do for your business?

The impact of all the buzz around design thinking today is that people are realizing that “anybody who has a challenge that needs creative problem solving could benefit from this approach,” Eppinger said. That means that managers can use it, not only to design a new product or service, “but anytime they’ve got a challenge, a problem to solve.”

Applying design thinking techniques to business problems can help executives across industries rethink their product offerings, grow their markets, offer greater value to customers, or innovate and stay relevant. “I don’t know industries that can’t use design thinking,” said Eppinger.

Ready to go deeper?

Read “The Designful Company” by Marty Neumeier, a book that focuses on how businesses can benefit from design thinking, and “Product Design and Development,” co-authored by Eppinger, to better understand the detailed methods.

Register for an MIT Sloan Executive Education course:

• Systematic Innovation of Products, Processes, and Services, a five-day course taught by Eppinger and other MIT professors.
• Leadership by Design: Innovation Process and Culture, a two-day course taught by MIT Integrated Design and Management director Matthew Kressy.
• Managing Complex Technical Projects, a two-day course taught by Eppinger.
• Apply for Innovation of Products and Services: MIT’s Approach to Design Thinking, an Emeritus Institute of Management course taught by Eppinger.

The expert

Steve Eppinger is a professor of management science and innovation at MIT Sloan. He holds the General Motors Leaders for Global Operations Chair and has a PhD from MIT in engineering. He is the faculty co-director of MIT’s System Design and Management program and Integrated Design and Management program, both master’s degrees joint between the MIT Sloan and Engineering schools. His research focuses on product development and technical project management, and has been applied to improving complex engineering processes in many industries.

Article link: http://mitsloan.mit.edu/ideas-made-to-matter/design-thinking-explained?utm_source=mitsloantwitter&utm_medium=social&utm_campaign=designthinkingexplainer