Hacker News new | ask | show | jobs
by com 597 days ago
Lots of people who should have been establishing effective security practices and monitoring and improving it were doing … something … but not that.

Total failure of management and governance at TfL and the British Library (which even had a “private sector security leader” on its board of governors for a decade or more before their total shitshow of a breach last year)

But as usual, there will be no consequences.

2 comments

TFL are better than most public bodies but are likely hamstrung on being able to pay anything like market rates for competent security people.
Totally get it that budgets are tight. But making sure that stuff happens isn’t highly correlated to tech staff or manager salaries.

Unless they’re hiring inexperienced high-schoolers, it’s a failure of will and competence in management. And even that would actually be a failure of managrnent.

I’m guessing - based on historic contacts with TfL - that this failure of management is probably manifest in too many meetings and intermediate products valorised over and above culture, knowledge and tech improvements.

Avoidance of outcome-based monitoring and governance, and instead a focus on “process execution” like reorgs, agonisingly-slow checkbox actions and deckchair relocations is pretty common in low-ambition, low-performance orgs. Again, you don’t get this because you’re being cheap on security people.

I’m not really sure how you’ve ended up classifying TfL as a “low-ambition, low-performance” org. As transit agencies go TfL is one of the best on the planet, they’re constantly innovating and pushing the envelope of what’s possible. Every time they build a new line, or order new rolling stock, they use it as an opportunity to invent something new (which doesn’t always succeed). Everything from automated trains, to more complex and capable signaling systems, improved cooling and better customer signage.

A “low-ambition, low-performance” transit organisation doesn’t run train services with a train every 90 seconds at peak, transporting 4 million people per day without a major incident or loss of life. There are nine Underground stations with annual passenger counts larger than the entire BART system in the larger Bay Area.

The Underground system alone (only part of TfL responsibility) is the world fifth largest metro system outside of china by ridership.

TfL built its own ticketing system, and invented the entire idea of using contactless bank cards for ticketing, including negotiating with Visa and Mastercard to create brand new rules for transit agencies. A system that it now sells to other mayor transit systems, such as the New York Subway.

TfL isn’t without faults and problems, like any large public organisation. But to dismiss it as “low-ambition, low-performance” is to ignore many decades of safety operating the worlds oldest metro system, and developing and exporting new ways of improving transit for the travelling public.

> no consequences.

I recommend "repercussions" ;)