This post is going to enrage some people…
The UK Civil Service employs half a million people. Most of them are using Microsoft’s Windows operating system and its associated applications such as Teams and Outlook. Is that value for money for the taxpayer? And are we making the right choice for national sovereignty and security? Let’s explore.
The cost of the UK’s current approach
I analysed the UK government’s excellent Contracts Finder to find all spending on Microsoft services and products—collectively, there was an eye-watering £576m per year. Some of that is good stuff—I’m pleased to see UK government departments using cloud compute, for example. But even just looking at just Windows, Microsoft365, Teams, SQLServer, PowerBI, and SharePoint, which we’ll call the “core stack”, it was £125m a year.1
1 The numbers in this piece are on a best endeavours basis—it is a blog post after all. Depending on how you count, and what time period you look at, there is a fair range. Some examples are £531m–£622m for total spend, and £226–£585 per year-FTE for core stack spending. There’s a cross-check to the experience of one German state later that suggests the potential savings I find are not implausible.
2 I also tried to get a ‘matched’ sample of departments’ spends and their number of full-time equivalent (FTE) staff. Using data from various sources on the number of staff employed by the organisations listed by the Contract Finder, I got a spend of £355 per FTE per year on the core Microsoft stack. I’ve used the more conservative number.
I probably don’t need to tell you that this is a lot of money in absolute terms, but it might still be a good deal—there are a lot of Civil Servants, after all. It works out to £250 per FTE per year.2
As a double check, I cross-referenced this with some listed prices for Microsoft’s Enterprise offerings on Microsoft’s own website. The basic version comes in at £402 per user per year, while the premium version is £980 per user per year! The user vs FTE distinction matters because—with more people making use of flexible working patterns—the cost scales with users even if they’re less than 1 FTE.
I’m not someone who advocates that the public sector should use the cheapest and worst version of everything to save money—quite the opposite, and such penny-pinching is self-defeating when you look at value through a broader lens. We’ve all known public sector workers wasting their most valuable asset—their own time—because of poor IT. Not only does this siphon away all enthusiasm for a job, it’s economically non-sensical because of the price of labour relative to the price of computing.
So, are there some cheaper options that are broadly as good, or perhaps even better? We need to look at the products that make up the typical tech stack that the licenses are buying, and ask what out there might do as good a job for free.3
3 Free can mean different things. Here, I mean free and open source software (FOSS). This means that while you might have to pay for hosting your data or a server to, well, serve that data up, the software and all its features are free.
- Microsoft Windows operating system. Cheaper option: Linux at £0.
- Outlook. Cheaper option: Thunderbird at £0.
- Word/Excel/Office suite. Cheaper option: LibreOffice at £0 (as they say on their website, “no forced AI.”)
- SharePoint. More complicated as SharePoint is a few things at once, but a cheaper option for intranet is Django at £0. (hat tip to the Cabinet Office, who already do this), Nextcloud Files Community Edition for a shared file system at £0, and paperless-ngx at £0.
- Teams. Cheaper option: Zulip at £0.
- SQL Server. Cheaper option: Postgres at £0.
So, the whole software stack could be a towering behemoth of free. I’m not sure how much hosting the data and servers costs, but not nothing, and we need to account for it. Let’s be generous to the UK government’s existing arrangements and assume something like the per user per year cost of a Dropbox account with 2TB of storage and 30 days’ of delete retention. This is a huge amount for most people in the public sector: I’ve had a Gmail account with 2TB of storage since 2004 and I haven’t used 100GB let alone 2TB! The cost per user per year of this basic Dropbox account is around £96. So we’re looking at savings of £154 per year per FTE. Over the 500,000 Civil Servants, that’s a cost saving of £77m per year.
Doing a similar calculation with the range of enterprise offerings listed by Microsoft, we’re talking about saving at least £153—£442m a year.
Don’t like this set of alternative software? Well, the UK state has such size and heft that it could easily hire some software engineers and build a bespoke software application, if it really wanted to. Or even sponsor development of one of the above in the exact direction it desired. AI means it’s now easier than ever to roll your own software. There would be an upfront cost, and some maintenance costs, but likely nothing compared to the Microsoft versions above. And of course, if you felt that only some of these switches away from Microsoft was right for your public sector org, you could choose to do just those.
I’ll also say that some of these options are, at least in my opinion, superior to the MS equivalents: sensible people can disagree but Postgres, Thunderbird, and Linux are genuinely excellent, industry-standard tools.
What happens if the stack switches away from Windows?
If we did this, would we need to throw out all the Windows laptops that are currently deployed to Civil Servants staff? No! Linux works on most (all?) laptops. So no need for new laptops, which makes this aspect of the transition cheap. And, yes, all of the software alternatives above work on Linux!
Laptops that had been switched to Linux would also likely work better: Linux consumes significantly less RAM at idle, (4.7GB vs 9.3GB in one test.) Many public sector laptops might only have 16GB of RAM to play with, so this is a large gain.
Linux also has significantly less bloat: it doesn’t serve ads when you try and search your own computer, it doesn’t force distracting “widgets” on your or AI integrations you didn’t ask for, and it certainly isn’t sending information on your use back to the developers. Linux runs only what you tell it to run, leaving more of your hardware dedicated to your active tasks. When you right-click and are running a standard version of Linux, you instantly get a menu pop-up. My personal experience of the public sector is that Windows stalls, and sometimes crashes, when you have the gall to do something as complex as right-clicking a file.
The way that the software is all bundled together is also problematic. There are quite a few people who would say that Excel is the leading spreadsheet software, but you’d be harder pressed to find people who rave about Teams, or enjoy SharePoint’s search function (which doesn’t work.) While the bundling may not be totally forced, it’s certainly encouraged, and you get the good bits with the bad bits. I think our public servants deserve better. There is no such bundling with Linux: you can choose the best tool for each individual job.
If you’ve used Outlook, you’ll know that crashes are just a fact of life. It doesn’t have to be that way, and it shouldn’t. Even if you don’t care for your own time, we should be wiser with the state’s assets. Linux has rock-solid stability, which is the reason it’s used for critical infrastructure and servers. Linux is what Android runs on, it powers the top one million web servers, and it’s the operating system of the world’s fastest supercomputers.
By the way, the time saved is economically meaningful. Let’s run through this. Say the average cost to the Civil Service of 1 FTE is £40k a year, and they lose just 2 minutes a day due to flaky software. Over the year, that’s a cost to the UK of £83m! I think it’s probably more in practice.
Now, of course there will be costs of the switch. The migration will need resources from good IT people, and laptops may be unavailable while they go through the switch-over. Based on the experience of one state in Germany, it looks like a one time switch-over cost of £8m.
Security and Sovereignty
Windows is known for being prone to viruses, though it’s a target because of its market share, and it’s a lot safer than it used to be. But it’s not as secure as the most popular variants of Linux, and there are flavours of Linux that are explicitly focused on security (but would come with painful trade-offs, no doubt.)4
4 Qubes OS, OpenBSD, and Kicksecure are examples.
The key point is that if the UK government decided that the trade-off between security and productivity/openness of any of the existing variants of Linux didn’t match its needs, it could just create a new one that did.
If you use Windows for critical systems then other people will have deep access to your computer. No single event better demonstrated this than when the unfortunately named American cybersecurity company CrowdStrike launched a flawed update and unleashed the world’s single biggest crash of 8.5 million systems. The crash happened because Microsoft had allowed a very deep form of access to people’s computers by a third party. Such kernel-level access had been closed off by Apple for MacOS in 2020, and it has never been available to third parties running Linux.5 I think, mostly, the CrowdStrike incident was unfortunate: whether provided by a third party or the creator, any update has the chance to go awry. What’s more concerning with Windows is the deep level of access that can be given to third parties without you even being aware of it. (If you’ve used Windows at all, you’ll also know that an unavoidable update is likely to land just as you’re about to give a presentation or leave the office.)
5 Microsoft blamed previous EU antitrust rulings that it said made it give kernel-level access to third parties… but the EU refutes this, and has pointed to the fact that kernel access is not necessary to fulfil the antitrust stipulation.
6 However, they presumably have to use Outlook’s search function, so can’t actually find anything.
Relatedly, with closed source and proprietary operating systems, there’s always the risk that a foreign state has put a backdoor into the machine. You can see how it would happen: if a company is based in country A, but it sells its operating system to country B, the security services of country A are going to be tempted to use that as a Trojan Horse to take a peek at what’s going on. There is evidence that the US’ National Security Agency had a backdoor into Outlook6:
Another newsletter entry stated that NSA already had pre-encryption access to Outlook email. “For Prism collection against Hotmail, Live, and Outlook.com emails will be unaffected because Prism collects this data prior to encryption.”
I don’t know the truth or extent of any access any state has into operating systems or other software. But I do know that if I wanted to protect my operating system from the possibility of a foreign state having a backdoor into it, I would be using an open source operating system that allowed me to know exactly what was going on. And the most mature open source operating system, behind Ubuntu, ChromeOS, and Android, is Linux.
Policymakers are taking note. One UK parliamentary select committee has urged the UK government to do more on the security and sovereignty of its IT.
If this is such a good idea, why haven’t more states done it?
You got me: it is odd how little switching away from Windows there is. That’s partly because of the bundling, the ubiquity, and that some of the software is loved by millions. I’m personally no fan of Excel, but there are lots of people who love it and—if you want to use spreadsheet software7—I’m not sure it has an equal.
7 Use code instead! See the part of this post about reproducible analysis.
Having said that, there are some examples of organisations getting off Windows. Actually, there are corners of the public sector that use MacOS instead; in the UK, it tends to be the most technical ones. As I’ve written before, MacBooks are actually a great deal economically compared with what the UK public sector might otherwise provide.
In terms of the switch to Linux, there are a few examples of that too. The French Gendarmerie use a custom variant of Ubuntu called GendBuntu. Germany has been in the vanguard of switching to free and open source software. Schleswig-Holstein estimates that 80% of its work computers run open source software and that it is saving $17.5m a year in licensing costs. They mention 40k workers, so this is a saving of £325 per year per FTE—higher than our conservative estimate above. And France’s central government is reportedly looking to move all ministries from Windows to Linux.
There have been some previous attempts in the UK: NHSbuntu was an Ubuntu-based Linux variant developed for the UK’s health service but was taken down by a legal challenge from… the UK Department of Health, who stood to gain from the savings. Apparently, a rename to “National Health Open Source” was not enough to stop the legal challenges. As one of the volunteers pointed out, this kind of heavy-handed approach to tinkerers trying to improve public services doesn’t exactly encourage innovation.
There are some other countries that have moved their governments to Linux: the Russian state has developed Astra Linux, and North Korea has Red Star OS. Make of that what you will. I’ll only say that these are countries that are more worried than most about foreign states interfering with their computer systems, and they’ve chosen Linux.
Conclusion
We have a number of estimates of the savings from switching away from Microsoft and its ecosystem now:
- £77m from looking at historical UK government contracts (a conservative estimate)
- £153m—£442m using numbers from Microsoft’s own website
- £162.5m based on the experiences of the German state of Schleswig-Holstein
Of course, there’s the cost of transition, which Schleswig-Holstein’s experience suggests is a one off cost of £200 per user. Weighed against that there’s the performance benefits at both the intensive (more RAM for what you’re actually doing) and extensive (fewer crashes) margins, worth, extremely conservatively, £83m. One could also argue that the revealed preference of UK voters is that sovereignty is important to them, and though it’s hard to measure the value8 people might put on this, it’s positive. Security would be tighter too—all the more important given recent high profile hacks.
8 For context, Brexit—which was partly about sovereignty—probably cost 6 or 8% of UK GDP, so something like £196bn.
Using the average of just the headline estimates, there is £131m a year on the table. This uses the lower end of the range of Microsoft’s own enterprise deals, so, again, is a conservative estimate.
It’s hard to conclude anything but that the UK should look at its free and open source software strategy urgently. £130m a year seems worth having to me.