Tag: artificial intelligence

The Facade of Progress: Why GovTech Barbados is Stalling Digital Transformation

nielharper

In the humid corridors of Barbados’ public service, there is a new buzzword circulating with the frequency of a tropical breeze: “GovTech.” Established in late 2023 with the high-octane promise of dragging a paper-clogged bureaucracy into the 21st century, GovTech Barbados Ltd. was heralded as the “silver bullet” for the nation’s digital woes.

However, as we move through 2026, the initial honeymoon period has ended. While the PR machinery hums with talk of “AI-powered prototypes” and “digital champions,” the average Barbadian citizen is still standing in physical lines, clutching paper forms, and wondering when the promised “sweeping transformation” will actually increase the ease of doing business.

The reality is that GovTech Barbados, despite its modern branding and high-profile leadership, is currently a victim of institutional inertia, misplaced priorities, and a “startup” culture that is fundamentally incompatible with the weight of government bureaucracy.

The Prototyping Trap: Appearance vs. Reality

The most visible “achievement” of GovTech Barbados so far has been the rollout of rapid “prototyping.” Using AI to turn a paper form into a digital interface in “minutes” sounds like a revolution. It makes for excellent LinkedIn posts and impressive demos for the Ministry of Industry, Innovation, Science and Technology (MIST).

But a prototype is not a service.

The “Prototyping Trap” occurs when an organization prioritizes the UI (User Interface) over the UX (User Experience) and the underlying backend processes. Turning a paper form into a digital PDF or a web form is the easiest 5% of digital transformation. The difficult 95% involves:

  • Integrating with the national identity system.
  • Automating backend approvals so a human doesn’t have to print the digital form to file it.
  • Introducing workflow management tooling to handoff tasks between different government departments or control points.
  • Updating the 40-year-old legislation that still requires a physical signature.

By focusing on what they believe to be “tangible outputs” to win public confidence, GovTech is essentially painting the windows of a house that has no plumbing. Citizens may fill out a form online, but if the “transformation” stops there, the inefficiency is simply moved from the front counter to a back-office inbox. Instead of focusing on throughput (how many forms can we digitize?), GovTech Barbados needs to focus on outcomes (how much time and money can we save the citizen?). It’s also quite telling that the GovTech team has neither the deep expertise nor a visible focus on ICT law and business process reengineering.

The CEO Dilemma: A Startup Mindset in a “Legacy” Environment

Mark Boyce, hired in July 2024, has brought a seemingly more tech savvy energy to the role. His background, marked by a vocal critique of the “safe” career paths of doctors and lawyers in Barbados, suggested he was the disruptor the island needed. However, in reality, Mr. Boyce does not have the qualifications or experience to lead a major national digital transformation initiative like GovTech Barbados. He has never led complex enterprise or government implementations which include cloud computing, interoperability layers, cybersecurity, e-commerce, digital identity, and big data. Unfortunately, neither has the majority of his key hires.

Digital transformation in a government setting is less like a tech startup and more like an organ transplant. The “host body” (the existing Civil Service) often rejects the “new organ” (GovTech) if the cultural and legislative prep work isn’t done.

I can’t help but to think that GovTech is operating as an isolated island of innovation. While Boyce and his team speak the language of “The Radical How” and “agile execution,” the rest of the government still speaks the language of “The General Orders” and “Financial Rules.” This cultural mismatch has led to a bottleneck where GovTech builds prototypes that sit in limbo for months because the “human review process” in traditional ministries remains unchanged.

The Sovereign Cloud and the “Hardware Hubris”

One of GovTech’s early and most controversial claims was that Barbados was “on the brink” of a sweeping transformation fueled by a Tier 3 data center and a “sovereign cloud.”

As I noted in a previous blog post, this often feels like “déjà vu.” Barbados has a history of announcing expensive infrastructure projects that fail to deliver service-level improvements. It’s important to note that:

  • Costs are astronomical: A greenfield Tier 3 data center can cost upwards of $20 million in capital expenditure, with millions more in annual operating costs.
  • Infrastructure vs. Service: A data center is just a room with servers. If the software running on those servers is poorly designed or the data remains siloed in different ministries, the “Sovereign Cloud” is just a very expensive local hard drive.

Furthermore, the focus on building local infrastructure ignores the global trend toward public cloud utilization (AWS, Azure, Google Cloud), which offers better security, scalability, and disaster recovery than a small island nation can typically manage on its own. The obsession with “sovereign hardware” often masks a lack of “sovereign software” capability.

A better approach would be a hybrid cloud model with a smaller footprint sovereign data center hosting “mission critical” and “secret” data (e.g., Digital ID, Electronic Patient Records, BimPay, etc.) and leveraging the public cloud for non-sensitive, high-scale applications (e.g., public-facing websites, information portals).

Missing the “Human” in the Human Firewall

For a “GovTech” agency, there has been a glaring lack of focus on the digital literacy of the civil service. Digital transformation is 10% technology and 90% people.

While GovTech talks about “Digital Champions” within ministries, these individuals are often overstretched civil servants with no formal technical training and no authority to change the processes they are “championing.” Without a massive, nationwide upskilling program for the thousands of government workers who actually process the forms, GovTech’s tools will remain shiny toys that no one knows how to play with.

The Transparency Deficit

Meaningful digital transformation requires trust. Yet, GovTech Barbados must be questioned for its approach to:

  • Cybersecurity: Barbados continues to score poorly on the ITU Global Cybersecurity Index. Announcing “AI-powered” government services without a robust, transparent cybersecurity framework or government-wide AI governance standard is a recipe for a national data disaster.
  • Data Protection: As GovTech moves to “release public datasets” to spur local tech growth, there are unanswered questions about how citizen privacy is being protected under the Data Protection Act. Where is the Open Data Policy? What about Freedom of Information (FOI) legislation? What will be the overarching data governance framework? Is the Data Protection Commissioner being continuously engaged?
  • Procurement: Is GovTech empowering local startups, or is it becoming a middleman for expensive foreign “turnkey” solutions that don’t fit the local context?
  • Digital Identification: Considering the existence of the Trident ID system, why haven’t centralized and federated digital ID been prioritized? GovTech should have already built a “Single Sign-On (SSO)” for all government portals. Instead of having separate logins for Taxes (TAMIS), NIS, and the Land Registry, a citizen uses one verified Trident identity. GovTech can also act as a “Trust Broker.” For example, local banks should be mandated to use the Trident ID API to verify a new customer’s identity instantly, rather than requiring them to visit a branch with a passport. Banking customers should also be able to login to their Internet and mobile banking applications with the Trident digital ID.

Notwithstanding a clear lack of transparency, GovTech Barbados has been granted a multi-million dollar budgetary increase in the 2026–2027 Estimates. The public must now ask: how is this agency being held accountable for its results – or the evident lack thereof?

The Verdict: Is it Transformation or Decoration?

As of early 2026, GovTech Barbados has achieved Digital Decoration. It has made the government look more modern, but it hasn’t made it work more efficiently.

For GovTech to move from a PR success to a systemic success, it needs to stop focusing on “tangible prototypes” and start doing the “unsexy” work of:

  1. Legislative Reform: Working with the Attorney General to kill the “physical signature” requirement once and for all.
  2. Interoperability: Forcing ministries to share data through a central API, so citizens don’t have to provide their birth certificate to five different departments.
  3. Radical Transparency: Publishing real-time KPIs on service delivery times, not just “how many forms we digitized.”

If GovTech continues down its current path, it risks becoming just another “State-Owned Enterprise (SOE)” – a well-funded agency that produces beautiful reports and prototypes while the people of Barbados continue to wait in the sun for a service that should have been a website click years ago.

Why CISOs Must Fight Back Against Scapegoating

nielharper

  • CISO ignores red flags in recruitment where business leaders repeatedly mention their “unique developer culture”.
  • CISO joins a major company which claims to be committed to cybersecurity.
  • CISO publishes 30-60-90 day plan and immediately performs a maturity assessment upon joining.
  • CISO meets with over 50 organizational leaders to outline their strategic vision and build support. Not a single person provides any meaningful input. The organization has no Internal Audit or Risk functions.
  • After completing the maturity assessment, CISO develops and publishes a draft cybersecurity strategy and multi-year roadmap for feedback. Not a single member of the executive management board reads the documents or provides feedback (including the CTO and CIO).
  • When asked about weak asset management (less than 35% of devices have EDR or MDM installed), the CIO states that developers don’t like being monitored. The CIO also states that cloud security posture management isn’t a priority (the organization employs a ‘multi-cloud strategy’ with a large footprint across multiple public clouds).
  • The organization’s CI/CD pipeline is fragmented with limited security controls. The CTO refuses to commit to robust security in the CI/CD pipeline because the organization is focused on code velocity and bringing new products/features to the market. CTO cannot explain why the Security Champions program failed.
  • The organization’s ecosystem is filled with thousands of vulnerable apps because there has literally been zero investment in relevant security controls. CISO develops a detailed plan addressing the people, process, and technology required to enhance security in the marketplace. The CISO is pretty much ignored.
  • The organization is obsessed with its annual SOC 2 audit (security theater).
  • CISO makes first presentation to executive management, addressing the security vision in accessible language such as business resilience, competitive advantage, market differentiation, regulatory compliance, collaborative risk management, etc. CISO highlights the “poor security culture” and asks that executive management make a formal statement about their commitment to security, authority to the CISO, and need for business leaders to own security in their domains and cooperate with the CISO. The executive management team is angry and criticizes the CISO for asking them to do what they see as his job.
  • A few weeks later, management and the CISO decide to part ways because of a “poor cultural fit”.

This is unfortunately a widespread scenario highlighting why the average CISO tenure is 18-24 months: poor tone from the top, unrealistic expectations, inadequate resources, accountability without authority, regulatory & legal pressure, and poor organizational culture.

It’s time for CISOs to pushback against these toxic situations!

Regulating AI Tech is No Longer an Option: It’s a Must!

nielharper

“Responsible, ethical use of AI is the key. From a corporate perspective, business leaders need to articulate why they are planning to use AI and how it will benefit individuals. Companies should develop policies and standards for monitoring algorithms and enhancing data governance and be transparent with the results of AI algorithms. Corporate leadership should establish and define company values and AI guidelines, creating frameworks for determining acceptable uses of AI technologies.

Achieving the delicate balance between innovation and human-centered design is the optimal approach for developing responsible technology and guaranteeing that AI delivers on its promise for this and future generations. Discussions of the risks and harms of artificial intelligence should always be front and center, so leaders can find solutions to deliver the technology with human, social and economic benefits as core underlying principles.”

I recently wrote a short piece on the ISACA Now Blog explaining why a robust framework of laws and regulations are needed for the potential of “AI” to be truly realised.

Check it out and let me know your thoughts!

Should We Fear the Era of Ubiquitous Computing?

nielharper

Eye Looking Over Person On Computer

More and more, technology is becoming an integral part of our lives. In a not so distant future, there will be a major convergence of entire industries in the fields of media, consumer electronics, telecommunications, and information technology. But the approaching wave of the technological revolution will affect us more directly, in all aspects of our lives – it is becoming apparent that our future will be characterized by the appearance of computing devices everywhere and anywhere. This concept is known as ubiquitous computing. Ubiquitous computing encompasses a wide range of existing technological platforms and emerging research topics, including distributed systems, ad hoc sensor networks, mobile computing, location-based services, context-aware computing, wireless networks, machine-to-machine (M2M) communication, artificial intelligence, and human-computer interaction.

Case in point, the functionality in smart mobile devices is constantly expanding into previously unthinkable dimensions. Wi-Fi positioning systems (WPS) and GPS can deliver location services as exact as 10 meters in an outdoor setting. Short-range radio interfaces (Bluetooth, ZigBee, Z-Wave, IrDA, etc.) are creating personal area networks (PANs) that better facilitate intrapersonal communication. Mobile phones can now be employed as personal base stations or “access points” that connect a universe of “smart devices”. As it relates to the unbanked or under-banked, technologies such as Near Field Communication (NFC) and Unstructured Supplementary Service Data (USSD) are allowing more individuals and entrepreneurs to participate in the ever-burgeoning mobile economy. From the perspective of e-health and remote patient monitoring, mobile watches (essentially wearable computers) are able to capture a user’s health data and, if necessary, transmit vital statistics back to a medical center via telemetry. In this regard, new qualities and functions are developing due to the proximity to the body that a normal mobile phone could not previously achieve.

Former IBM Chairman Lou Gerstner conceptualized a “post-PC era” where he foresaw, “…a billion people interacting with a million e-businesses through a trillion interconnected intelligent devices.” Smartphones with high-speed data connections, geo-location positioning, and voice recognition capabilities that contextually interact with their environment are the first indicators of this type of ubiquitous virtual network of technical devices and day-to-day objects. Such developments are only now being realized due to rapid advances in technology. For example, semiconductor technology has progressed to a point where complex functions have been miniaturized; so as to obtain drastically reduced form factors — weight, size and energy consumption. The field of “Body Area Networks” has broken new ground whereby the human body can be employed as a transmission channel for low voltage electromagnetic signals. Touch, gesture and other tactile interfaces can initiate individualized communications, and be deployed for user authentication, personalized device configuration, or billing of products and services.

While determining concrete applications for such technologies is a difficult task, the potential for objects to communicate with each other, use available Internet services, and access large online data stores, is simply mind-blowing. The field of ubiquitous computing, and its array of technologies, is creating linkages between the mundane world and everyday objects, between products and services and capital assets, and between e-commerce platforms and supply chain management systems. They are effectually removing human beings as intermediaries between the real and the virtual world. As a result, new business models are emerging that are providing incremental benefits to manufacturers, suppliers, and customers. More importantly, we are seeing the ultimate creation of a plethora of new services such as the persistent personalization or customization of products throughout their entire life cycle.

Despite the obvious social and economic value of ubiquitous computing, particular attention needs to be focused on the issues of security and privacy. The promise of ubiquitous computers is accompanied by a broadening of the traditional Internet problem of “online history” (i.e. the collection of online user activity into big data sets) to include an even more extensive “offline history”. As such, whereas the online surveillance of individuals has been restricted to Internet usage, there will now be no clear delineation between “online” and “offline” data collection in a world of pervasive smart objects. Without a doubt, this will make the resulting data much more valuable. But who will be deriving value from this data (or more so profiting)? Whereas previously a limited profile of an individual could be “built” through data analytics, a much more comprehensive view of this person and his/her daily activities can be obtained in the ubiquitous reality. The question is: Do we really want others to have this much insight into our lives?

In his lecture, “The Ethicist’s and the Lawyer’s New Clothes: The Law and Ethics of Smart Clothes,” Glenn Cohen asserts that the ubiquity of computers threatens to “disrupt the place of refuge.” He warned that even when we switch off our mobile phones, given the prevalence of smart devices, “we squeeze out the space for living a life.” He concludes, “Lots of people have things they want to do and try but wouldn’t if everything was archived.” Should we expect the government and the rule of law to protect us in the ubiquitous world? In the post-Snowden era, we would be foolish to harbor such false expectations. Taking into consideration that most online surveillance activities are undetectable, the odds of anyone securing a legal claim against corporations or governments are slim to none.

In an ideal world, having business responsible for baking robust privacy controls into their products seems to be an optimal solution. But this means that we have to be able to trust the companies (a tall order in my estimation). Most recently, the technical community, in the form of the Internet Engineering Task Force (IETF), has renewed its commitment to building greater security into Internet protocols such as HTTPS and through the use of Transport Layer Sockets (TLS) and Perfect Forward Secrecy (PFS). However, there are significant limitations in the use of technology-only fixes to enhance privacy and security on the Internet (and ubiquitous computing will be no exception). Operational practices, laws, and other similar factors also matter to a large extent. And at the end of the day, no degree of communication security helps you if you do not trust the party you are communicating with or the infrastructure and devices you are using. With all that has happened over the last 24 months in terms of pervasive online surveillance, should we be fearful of what the ubiquitous era holds for us? I wouldn’t necessarily say that I’m afraid, but neither am I brimming with unbridled confidence.

Mind you, I am not by any means a pessimist. There is no doubt that ubiquitous computing will provide vast opportunities for improvement in the realms of our political, commercial, and personal existence. However, the multitude of concerns around governance, standards, integration, interoperability, security, and privacy will necessitate an effective multi-stakeholder approach. The demand will be for unprecedented collaboration among the technical community, academia, business, and government. My fear is that the concerns of the end user will be largely ignored amidst the jostling for position by the others players.