Sokratis Vavilis
email: s.vavilis@tue.nl

Milan Petković
email: milan.petkovic@philips.com

Nicola Zannone
email: n.zannone@tue.nl

Impact of ICT on Home Healthcare

Keywords: healthcare security, home healthcare, trust management

Innovation in information and communication technology has a great potential to create large impact on modern healthcare. However, for the new technologies to be adopted, the innovations have to be meaningful and timely, taking into account user needs and addressing societal and ethical concerns. This paper focuses on ICT innovations related to the home healthcare domain.

To ensure the adoption of new healthcare services, the new innovative technologies need to be complemented with new methods that can help patients to establish trust in healthcare service providers in terms of privacy, reliability, integrity of the data chain and techniques that help service providers to assess the reliability of information and data contributed by patients. This paper sketches various lines of research for the development of trusted healthcare services namely, patient compliance, reliability of information in healthcare, and userfriendly access control.

Introduction

The high bandwidth connectivity provided by the Internet enables new services to support citizens in their daily lives. An important category of these services is healthcare services. The first examples of these services already exist today, and soon new services will emerge offering increased sophistication and improved but cheaper healthcare. An exponential growth of these services is expected, due to two tendencies. First, demand for care and cures will increase over the next decades caused by the ageing population (within 40 years, one in every four people will be over 60).

Secondly, the number of healthcare workers is expected to diminish relative to the total population (without changes to the healthcare system, 25% of the working population would be needed to provide today's level of care by 2040 in a typical western country). New ICT supported healthcare services can overcome this problem by allowing people not to rely only on traditional care. However, to ensure the adoption of new healthcare services, the new innovative technologies need to be complemented with new methods that can address related ethical and societal issues.

A good example is home healthcare. Current home healthcare services are rudimentary in nature. Often they rely on call centers or nurses visiting the patient while new propositions are based on the Internet. One of the important impediments for the use of the Internet is the lack of trust. Trust is a requirement for the widespread adoption of healthcare services by clients (patients), by caregivers and by the parties that are financially responsible.

Existing techniques address part of the trust and security requirements, for example tools for identity management and for encryption of connections. Missing are techniques that help end-users to establish trust in a healthcare service in terms of privacy, reliability, integrity of the data chain, as well as techniques that help physicians to assess the reliability of information and data contributed by patients. There is a need for an integrated and easy to understand approach to trust in terms of security, privacy, and transparency, where users can make informed decisions whether to trust a service and can control the usage of their personal information.

In this paper, we present the research lines for trust management in home healthcare services. Home healthcare services aim to support people who are chronically ill or who are rehabilitating. These services gather patient's sensitive information that is then interpreted by medical professionals to manage their diseases. The adoption of such services, however, hardly relies on the patients' trust in a healthcare service provider in terms of privacy of the data chain and physicians' trust in the reliability of information and data contributed by patients. In particular, a number of questions should be addressed:  How can compliance with a treatment be reliably measured?  Can a physician trust data measured by a patient at home?  How can patients use home healthcare services while ensuring their privacy and controlling the use of information in a simple intuitive way?

Answers to these questions require investigating different research lines including patient compliance, reliability of information in healthcare, and user-friendly access control. The paper discusses the existing proposals in these areas and describes a research plan for enhancing the state-of the-art.

The structure of the paper is as follows. The next section presents the impact of ICT innovation on healthcare. Section 3 discusses the problem of trust towards healthcare services. Section 4 discusses trust management for home healthcare services. Finally, Section 5 concludes the paper providing directions for future work.

ICT innovation in Healthcare

The advance of ICT technologies is leading to the design of novel electronic healthcare services that improve people's health and well-being but also extend beyond the individual towards sustainability of our society. Consequently, many countries created policies to foster innovation and spread the successful adoption of these technologies in their healthcare sector. In this process of innovation creation it is crucial to focus on meaningful innovations, sustainability, and societal and ethical values underpinning the innovations. Meaningful innovation means new ideas, new approaches, new solutions that make lives healthier, more enjoyable, and more productive. It also means that they should be driven by user needs (not by technology), taking into consideration economic, societal and environmental sustainability. They should be well timed and introduced when they really make sense.

In healthcare, we witness many examples of such innovations ranging from electronic health records (EHRs), clinical decision support systems, via medical apps for mobile devices to next generation gene sequencing. The creation of national/regional EHR infrastructures such as RHIO's in the US, the NHS Spine project in the United Kingdom and NICTIZ in the Netherlands, is complemented with efforts on creating commercial Web-based personal health record (PHR) systems such as Microsoft HealthVault. These applications process, store, and exchange patient's medical information and allow for harnessing big data to improve healthcare.

Clinical decision systems assist healthcare providers with decision making tasks. They allow clinicians to take into account all important clinical observations and upto-date clinical knowledge when diagnosing and treating patients.

Advances in mobile Health (mHealth) allow healthcare providers and patients to take part in a revolution in the way healthcare information is accessed and delivered. Healthcare providers and patients can access the most up to date medical resources anytime anywhere on their mobile devices.

New technologies for genome sequencing will make possible that everyone's genome is sequenced quickly for an affordable price, which is expected to decrease to one thousand dollars very soon. This will allow not only quick and cheap sequencing, but it will allow for the use of genomics in diagnostics and treatment enabling personalized medicine.

Finally, there are an increasing number of extramural telemedicine applications in the home healthcare domain such as remote patient monitoring (RPM). RPM systems combine consumer electronics and the Internet to connect patients and their care providers, thus enabling new care models. They allow patients to stay at home attached to monitoring devices/sensors that are getting smaller and wireless. In this way, patient's physiological and other contextual data can be collected and transmitted to remote care providers for review or intervention. Typically, RPM systems comprise several measurement devices (such as a blood pressure meter, weighing scale or glucose meter) a medical hub device that collects the data from measurement devices and sends them to a backend service. Furthermore, a hospital EHR or PHR systems are also considered as part of this eco system (the measurement data are sent from the medical hub to a PHR system, but in certain cases they are sent from the medical hub to a backend service which forwards them to an EHR or PHR system). A typical architecture of an RPM system as defined by the biggest standardization initiative in the domain of personal healthcare, called Continua Health Alliance1 is shown in figure 1.

In this paper we will focus on home healthcare technologies, as they are very controversial. On one hand, these technologies improve the quality of patient life (he can stay at home), and provide faster and cheaper healthcare services. On the other hand, they are exposed to different security and safety threats as the patient is far from healthcare providers, and it becomes simpler to collect, store, and search electronic health data, thereby endangering people's privacy.

Trusted Healthcare Services

Electronic healthcare services offer important economic and social benefits for our society. Patients rely on these services for their safety and care and for improving their quality of life. For physicians, electronic health and wellness services offer support for providing more effective and continuous care. For insurers and governments, these services bring a reduction of costs, and for commercial service providers, this is a new business opportunity. However, electronic healthcare services cannot be exploited until the trust question has been addressed in a fundamentally correct way. Indeed, trust is a pre-requisite for the acceptance of these services by end users. Trust establishment is crucial for physicians and service providers as they will use healthcare services to implement and extent (medical) treatments. In particular, healthcare providers need to trust the patient data they obtain remotely from the measurement devices deployed in patient's home. It is crucial for them to know that a vital sign of a registered user is measured (not of his friends/children), that the measurement was taken with a certified device, under standardized conditions (e.g., with the blood pressure cuff on the arm at the heart level) and that it is not obtained as a result of device malfunctioning.

In a healthcare setting, trust is also of special relevance because healthcare services deal with very personal and private information. Home healthcare services monitor patients and gather data that are interpreted by medical professionals. Health and wellness services support people in need in many ways on the basis of personal and health related information. People in health communities share health and well-being information which then becomes potentially available to the whole community and beyond.

Privacy is a major concern of many citizens and the government has an important role in protecting the privacy of the citizen [START_REF] Guarda | Towards the development of privacy-aware systems[END_REF]. Therefore, the government has developed legislation to protect its citizens, who may make use of the legal facilities provided. For example, on December 17, 2008, 2% of the Dutch population (330.000 people) had submitted objection forms to the Dutch Ministry of Health, stating that their electronic health records cannot be shared electronically. 2To facilitate the acceptance of electronic healthcare services, it is necessary to develop the technology that help end users to establish trust in healthcare service providers in terms of privacy, reliability, integrity of the data. Standard Internet security techniques provide authentication and encryption of the communication with a service provider. However, they do not provide the user with means to control or even know how a service provider will actually use their personal information. It is important to have mechanisms in place that allow users to make an informed decision to trust a service provider on the basis of facts, such as reputation and security attributes.

The THeCS project addresses the very important trust questions (transparency, privacy and security) for healthcare services. THeCS is a Dutch national project in the COMMIT program with 11 partners including representatives from industry, Dutch research institutes, Dutch universities and hospitals. The project addresses trust as one of the key issues for new electronic healthcare services. It will create measurable and enforceable trust. This notion is new for electronic healthcare services (and for Internet services in general), and it is fundamental for their success. The objective of THeCS is to create new techniques for measuring and controlling the reliability and use of (healthcare) information. These techniques allow users and service providers to trust each other and to benefit from these new services.

The concrete goal of the THeCS project is to create and define:

 Ethical, legal, sociological and psychological requirements for trust in healthcare services. The spectrum of healthcare services is very wide, ranging from formal medical services to pure commercial services that support every day activities. Often these services share information. It is this integration of services from different domains and information sharing that is of particular interest.  A technical protocol to reliably assess the quality of medical data (e.g., blood pressure) measured by patients at home, including the identification of the patient, compliance with the specified measurement protocol, and certification of the measurement device.

 A cryptographic technology that enables health service providers to process encrypted medical information so that only intended operations are possible and that information is not disclosed otherwise. A specific example is categorization of a community into groups of patients with similar (according to a definition relevant for healthcare) characteristics, without disclosing the characteristics of individual patients.  A cryptographic technology for privacy preserving data mining of patient health data to support clinical research and knowledge creation for clinical decision support systems.

In the remainder of this paper, we will focus on trust management for home healthcare services.

4

Trust Management for Home Healthcare Services

Home healthcare services have been proposed to decrease the cost of healthcare while making it more comfortable for the patient. These services aim to support people who are chronically ill (e.g., post-stroke, diabetes, Chronic Obstructive Pulmonary Disease (COPD)) or people who are being rehabilitated. They monitor the health and wellbeing of people, enabling tailored assistance where and when needed. In particular, they gather sensitive personal information that is then interpreted by medical professionals in order to provide treatment. The adoption of such services, however, hardly relies on the trust that both patients and medical professionals have in the provided healthcare services. In particular, a number of questions should be addressed:

 How can compliance with a treatment be reliably measured? Patients' adherence to medication and to the treatment in general (e.g., activities, exercises, dietary guidelines) is a fundamental factor for the success of a treatment. However, treating a certain disease usually requires a variety of different medication schemes and treatment plans, making the compliance checking a complex task.  Can a physician trust data measured by a patient at home? Home healthcare patients measure physiological parameters at home and a physician uses the data to make treatment and diagnosis decisions. It is very important that the measurements are accurate and that a physician can accept them as medical information.  Patients and consumers want the possibility to control their personal health information. How can patients use home healthcare services while ensuring their privacy and controlling the use of information in a simple intuitive way?

Answering these questions requires developing the technology for physicians and other users of measured home healthcare information to easily determine the trustworthiness of the information and patient compliance. Moreover, there is the need of user-friendly technologies which will allow patients to control the processing and sharing of their information. In the remainder of the section, we discuss various research lines to address these challenges.

Patient Compliance

In home healthcare services, patients do not receive treatment (e.g., medication, rehabilitation) directly at the hospital; rather, healthcare service providers prescribe treatment to their patients who should follow such a treatment at home. This, however, leads to a question on how to assess patient compliance with the prescribed treatment.

Compliance with a medication regimen or a treatment is generally defined as the extent to which patients take medications and follow the treatment as indicated by their healthcare providers [START_REF] Osterberg | Adherence to medication[END_REF]. The adherence to a treatment by the patient is crucial both for the treatment evaluation and for the patients' recovery. However, given the large range of existing treatments, patient compliance is difficult to assess.

Several solutions for patient compliance have been proposed in the literature. A number of proposals focus on medication adherence. Here, compliance measurement methods can be classified in direct and indirect methods [START_REF] Osterberg | Adherence to medication[END_REF]. Direct methods measure, for instance, concentration of a drug or its metabolite in some biologic factor such as blood. Indirect, methods are based on the assessment of clinical responses by medical professionals, patient questionnaires about adherence, patient diaries, and pill counting. Other types of adherence measurements [START_REF] Hess | Measurement of adherence in pharmacy administrative databases: a proposal for standard definitions and preferred measures[END_REF][START_REF] Steiner | The assessment of refill compliance using pharmacy records: methods, validity, and applications[END_REF][START_REF] Halpern | Recommendations for evaluating compliance and persistence with hypertension therapy using retrospective data[END_REF][START_REF] Leslie | Calculating medication compliance, adherence and persistence in administrative pharmacy claims databases[END_REF] include medication possession ratio and related measures of medication availability, discontinuation/continuation, switching, medication gaps, refill compliance, and retentiveness/turbulence. A comprehensive list of existing methods is presented in [START_REF] Andrade | Methods for evaluation of medication adherence and persistence using automated databases[END_REF].

An example of an indirect method is proposed in [START_REF] Mabotuwana | A Semantic Web Technology Based Approach to Identify Hypertensive Patients for Follow-Up/Recall[END_REF]. This work aims to identify hypertensive patients who do not adhere to prescribed medication using an ontology based approach. In particular, patient information such as patient prescription details, medication possession ratios and blood pressure measurements are specified in an ontology. Adherence of patients to medication is then determined by querying the ontology using non-adherence criteria (e.g., patient who have lapsed in taking their medication while having a low medication possession ratio).

Recently, advances in patient monitoring systems have made possible to remotely monitor the patient to keep track of his health status, as well as providing limited abilities to monitor compliance. Such solutions include, for instance, the application of body sensors [START_REF] Reiter | HeartCycle: Compliance and effectiveness in HF and CAD closed-loop management[END_REF][START_REF] Otto | System architecture of a wireless body area sensor network for ubiquitous health monitoring[END_REF][START_REF] Alemdar | Wireless sensor networks for healthcare: A survey[END_REF], smart device integration for patient monitoring [START_REF] Schmidt | Acceptance of telemonitoring to enhance medication compliance in patients with chronic heart failure[END_REF][START_REF] Pang | A pervasive and preventive healthcare solution for medication noncompliance and daily monitoring[END_REF] and event-based methods [START_REF] Mouttham | Event-driven data integration for personal health monitoring[END_REF], which aim to capture the patient's activities and vital metrics. In addition, some preliminary work on patient compliance prediction has been done by applying statistical methods and text mining techniques [START_REF] Petrou | Use of text mining to predict patient compliance[END_REF].

In summary, several efforts have been devoted to the definition of methods for treatment adherence. However, existing solutions only concentrate on a specific type of treatment such as medication adherence or monitoring of patients' activities. These efforts are insufficient in practice as the treatment for certain diseases often consists of different types of treatments. The effectiveness of the treatment can be assessed only by assessing and combining the adherence to the single treatments.

Providing a solution for patient compliance to the treatment still remains a challenge. In particular, we need comprehensive solutions for measuring patient compliance for home healthcare services. The development of such solutions requires investigating and integrating existing measurement mechanisms for patient compliance.

The study should not be limited to existing solutions specific for healthcare, but it should consider compliance checking techniques proposed in other domains like privacy and business process [START_REF] Banescu | Measuring privacy compliance with process specifications[END_REF][START_REF] Petković | Purpose Control: did you process the data for the intended purpose?[END_REF].

Reliability of Information in Healthcare

To assess patient health status, healthcare providers have to rely on measurements which may have been taken directly by the patients. Thus, trust and reliability of the measurements is a necessary condition for the acceptance of the service by healthcare providers. Next to ensuring proper patient/device authentication, data authenticity and integrity, it is important to capture the correctness of the authentication process too. An overall solution that can capture all these aspects is the application of reputation systems, where providers build a level of trust in the patient based on his ability to take measurements [START_REF] Van Deursen | Hedaquin: A Reputation-based Health Data Quality Indicator[END_REF]. Reputation systems have been studied in the literature for different domains, such as auction websites and peer-to-peer sharing networks [START_REF] Jøsang | A survey of trust and reputation systems for online service provision[END_REF]. Lately, reputation systems have been proposed for healthcare. Most existing approaches, however, focus on the patient perspective, where patients rate the services of doctors and healthcare providers via a web portal or a health oriented network [START_REF] Jøsang | Online reputation systems for the health sector[END_REF][START_REF] Ebner | Trust in Virtual Healthcare Communities: Design and Implementation of Trust-Enabling Functionalities[END_REF]. Conversely, very few studies address patients' trustworthiness from the perspective of healthcare providers and in particular the reliability of measurements taken by patients. Existing proposals [START_REF] Van Deursen | Hedaquin: A Reputation-based Health Data Quality Indicator[END_REF][START_REF] Alhaqbani | A medical data reliability assessment model[END_REF] mainly focus on the reliability of the data maintained in the form of electronic and personal health records.

Additional problems appeared with the use of web portals rating healthcare services. Patients often subscribe to expert websites and search information regarding their illness on the Internet. Although this practice may have advantages, the major drawback concerns the trustworthiness of information. For instance, in Revolution Health 3 and other similar online community reputation systems, the trustworthiness of information is assessed only by considering the information source. To assure information trustworthiness we also need to consider the information itself [START_REF] Bertino | The challenge of assuring data trustworthiness[END_REF][START_REF] Moturu | Trust evaluation in health information on the World Wide Web[END_REF].

Summarizing, there are no comprehensive studies on assessing the trustworthiness of patients' measurement and on addressing the problem of trust in home healthcare services. Moreover, to reassure patient safety, a method for measuring the trustworthiness of information originating from the Internet should be integrated. An interesting research challenge is, thus, the design of solutions for measuring information trustworthiness for home healthcare that also address the trust issues related to Internet data. We believe that a reputation-based solution can ensure the reliability of home healthcare data needed by physicians. To this end, it is necessary to investigate the issue of data trustworthiness from both healthcare providers and patients' perspectives and elicit the requirements for reputation systems to be deployed in healthcare systems. To get such systems accept by end-users, information on data reliability should be easily accessible and understandable. Therefore, methods for assessing data reliability should be coupled with methods and tools that visualize indicators for data reliability in a way that is understandable by end-users.

User Friendly Advanced Access Control

Healthcare services deal with very personal and sensitive information. The protection of sensitive information is usually enforced using access control. Several access control models have been proposed in the literature (see [START_REF] Samarati | Access control: Policies, models, and mechanisms[END_REF] for a survey). In particular, access control for the healthcare domain has been intensively studied in [START_REF] Zhang | A role-based delegation framework for healthcare information systems[END_REF][START_REF] Becker | Cassandra: Flexible Trust Management Applied to Electronic Health Records[END_REF][START_REF] Røstad | Access control in healthcare information systems[END_REF]. The challenge in designing an access control system for healthcare is that, while posing strict constraints on the access to sensitive information, the system has to cope with the dynamic environment of healthcare and the potential exceptions that are raised in emergency cases. Furthermore, medical data can also be formed as arbitrary text, such as a patient report made by healthcare practitioners, leading to the need for policies based on content. In this trend, content-based access control [START_REF] Hart | More Content -Less Control: Access Control in the Web 2.0[END_REF][START_REF] Giuri | Role templates for content-based access control[END_REF] and tag-based access control [START_REF] Hinrichs | TBA: A Hybrid of Logic and Extensional Access Control Systems[END_REF] methods have been proposed. For instance, content-based approaches have been used for the protection of medical images [START_REF] Tzelepi | A flexible content and context-based access control model for multimedia medical image database systems[END_REF]. Although these access control models are very expressive and allow the specification of a wide range of authorization policies, they are usually difficult to use by end users. The last years have seen an increasing interest in the development of user friendly privacy management and access control systems. For instance, various enterprises designed platforms which allow users to set their privacy and access control policies. One example is Google dashboard privacy tool, which through a web interface displays to users what information about them is stored and who can access it. Similarly, social networks such as Facebook let users restrict or grant access to other users or groups on their data (e.g., wall posts, photos). Although these proposals provide a simple and straightforward solution, they neither allow users to understand the effect of the specified policies nor ensure secure access control.

Therefore, a need for more flexible yet friendly privacy management exists. Efforts such as privacy dashboard 4 , PrivacyOS project5 , Primelife project6 ) and privacy room [START_REF] Kahl | How to Enhance Privacy and Identity Management for Mobile Communities: Approach and User Driven Concepts of the PICOS Project. In: Security and Privacy -Silver Linings in the Cloud[END_REF] provide tools (e.g., browser add-ons, mobile applications) for regulating the exposure of user data to the network. Pearson et al. [START_REF] Pearson | A Privacy Manager for Cloud Computing[END_REF] propose a client privacy management scheme based on data obfuscation (not necessarily using encryption) and user "personas." Although these proposals increase usability and flexibility, they do not provide users with the overview of the effect of the specified policy.

In conclusion, although several studies on access control have been carried out, no comprehensive studies on user-friendly access control for healthcare exist. The challenge is to define a novel access control model that guarantees an appropriate level of security and allows users to specify the policies regulating the exposure of their information to others. In addition, the model should be easy to use by end users. Ideally, the access control system should not only allow users to define access rules to their data but also to support them in "visualizing" the effect of the defined access control policy and therefore in ensuring that the created policy reflects users' intentions. The lack of such an overview might result in a loss of sensitive information. As an example, a patient affected by HIV might want to prevent the disclosure of information regarding his medical condition, restricting access to information regarding his disease (e.g., HIV status, HIV antibodies). However, the patient might not restrict access to other fields (e.g., white blood cell count, CD4 T-cells count) from which, although they do not contain his HIV status, his disease may be inferred.

The design of a user-friendly access control model requires that we divide the access control model conceptually into two layers: a high-level layer, in which end users can specify privacy preferences, and a low-level layer, which consists of machinereadable policies eventually enforced by the system. The refinement and mapping of high-level policies (specified by users) into enforceable policies can be achieved, for instance, by enabling semantic interoperability between high-level descriptions of information to be protected and the data objects in which such information is stored. The aim of this semantic alignment is to support the automatic generation of enforceable policies from the high-level policies specified by users. As a result, enforceable policies can be dynamically customizable with respect to user preferences.

Conclusions

The growth of the Internet and ICT technologies had a large impact on modern healthcare. A fundamental need is to design novel electronic healthcare services that improve people's health and well-being but also extend beyond the individual towards sustainability of our society. However, although the use of ICT in healthcare can offer several benefits to society, the adoption of electronic healthcare services relies also on ethical and societal aspects such as the trust that end users (e.g., patients and physicians) have towards such services. This paper discussed the challenges for developing trusted home healthcare services. The THeCS project addresses the issue of trust in healthcare services. In particular, the project aims to define the technology necessary to deploy trusted healthcare services. We presented various lines of research that will be also investigated within the project to address such challenges, namely patient compliance, reliability of information in healthcare, and user-friendly access control.

Fig. 1 .

 1 Fig. 1. Architecture of an RPM system.

http://www.continuaalliance.org

See www.minvws.nl/kamerstukken/meva/2008/bezwaarprocedure-epd.asp.

http://www.revolutionhealth.com/

http://code.w3.org/privacy-dashboard/wiki

https://www.privacyos.eu/

http://www.primelife.eu

Acknowledgements

This work has been done in the context of the THeCS project which is supported by the Dutch national program COMMIT.


Marthie Grobler
email: mgrobler1@csir.co.za

Joey Vuuren
email: jjvvuuren@csir.co.za

Louise Leenen
email: lleenen@csir.co.za

Joey Jansen Van Vuuren

Implementation of a Cyber Security Policy in South Africa: Reflection on Progress and the Way Forward

Keywords: cyber security, ontology, policy, security awareness

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Information and its related infrastructures are fundamental to cyber security and the implementation of an associated cyber security policy. On the one hand, cyber security pertains to the maintenance of National Security and the interests of citizens; whilst, on the other hand, it can refer to politically motivated hacking to conduct sabotage and espionage against specific nation states. Therefore, the rationale behind national cyber security is to enable the safekeeping of a Nation's constituency and its associated organisational, human, financial, technological and informational resources. This is done to facilitate the achievement of its National objectives [START_REF] Ghernouti-Hélie | A National Strategy for an Effective Cybersecurity Approach and Culture[END_REF]. In South Africa, cyber security has been identified as a critical component contributing towards National Security. More geographical regions of South Africa are becoming integrated into the global village, necessitating additional government initiatives aimed at bridging the digital divide and addressing cyber security. One of these initiatives is the development and implementation of a South African specific cyber security policy.

Despite the African continent's recent explosive growth in information and communication technologies, Africa is generally considered as being spared the global high levels of cyber crimes. Although this is often attributed to its traditionally low Internet penetration levels with only 139 million Internet users out of a population of more than 2 billion people [START_REF]Internetworldstats: Internet Usage Statistics for Africa[END_REF], Africans tend to increasingly fall prey to online predators [START_REF] Guy | Cyber Security Policy Will Go Before Cabinet For Approval This Year[END_REF]. In addition, many of the factors that traditionally make African countries more vulnerable (such as increasing bandwidth, use of wireless technologies and infrastructure, high levels of computer illiteracy, ineffective or insufficient legislation to deal with cyber attacks and threats) further expose these countries' crucial infrastructures to cyber risks [START_REF] Grobler | Global Cyber Trends a South African Reality[END_REF]; hence an effective cyber security policy is urgently needed in order to be able to respond to these risks. A national cyber security policy framework would "bolster and improve South Africa's cyber security" [START_REF] Guy | Cyber Security Policy Will Go Before Cabinet For Approval This Year[END_REF].

This article will look at the current and future research and development done towards the implementation of a cyber security policy in South Africa. It will present retrospective reflections, as well as proposed future work on selected methodologies and frameworks that will enable the implementation of such a policy. The innovative contribution of this research lies in the argument that an ontology can assist in defining a model that describes the relationships between different cyber security components. Section 2 summarises the development process of a cyber security policy for South Africa. Section 3 gives an overview of cyber security research in South Africa and discusses ways in which the research relates to the development of a cyber security policy. From these two sections it becomes clear that a descriptive model of the cyber security environment in South Africa is required. This leads to a proposal for the development of a cyber security ontology in Section 4. Future research is discussed in Section 5 and the article is concluded in Section 6.

Background

South Africa has a huge responsibility to promote cyber security awareness, since the State can be held responsible for wrongful acts committed inside a country, and is obliged to fulfil the interests of the entire international community. As a result, the national cyber security policy framework for South Africa is a long time coming, and initial workshops on the topic were held only in January 2009. Despite the time and effort put into the development of the policy framework, the process of implementation is still not complete. At the time of writing, the draft version of the policy (dated October 2011) declared the milestones for the establishment of the security CSIRT (Computer Security Incident Response Team) and the sector CSERT (Computer Security Emergency Response Team) as the end of March 2012 [START_REF]National Cybersecurity Policy Framework for South Africa -Final Draft[END_REF]. Due to mandate related challenges amongst others, these milestones have not been met; the decision was made in February 2012 that the Department of State Security should take over responsibility from the Department of Communications (DOC) for drawing up the government's policy on cyber crime [START_REF] Davis | State Security in Charge of Cybercrime Plans[END_REF]. In 2010, a similar decision was made to reassign the mandate from the Department of Science and Technology (DST) to the DOC [START_REF] Grobler | Common Challenges Faced During the Establishment of a CSIRT[END_REF].

Given the current status of the policy framework in South Africa, it is agreed that there is not enough emphasis on the national cyber security policy, although reference is made to the policy as the overarching strategy that must guide cyber security. In response, this article proposes five elements as a foundation for the South African cyber security policy requirements: (i) political will; (ii) adapted organisational structures; (iii) identifying accurate proactive and reactive measures; (iv) reducing criminal opportunities; and (iv) education and awareness [START_REF] Ghernouti-Hélie | A National Strategy for an Effective Cybersecurity Approach and Culture[END_REF].

It is recommended that these five elements should be present in developing a national strategy for an effective cyber security approach and culture. The next section addresses these elements in more detail, with a preliminary mapping of current South African cyber security research to determine the current state and progress of a cyber security policy implementation. These elements fit with the South African proposed multi-faceted approach to reduce cyber crime [START_REF] Davis | State Security in Charge of Cybercrime Plans[END_REF].

Current State of Cyber Security Research in South Africa

The dynamic and volatile nature of the Internet and the cyber domain in general make cyber security research within South Africa an important area to address. Since the cyber domain is inherently globalised, it cannot truly be considered in isolation or on a purely national basis [START_REF] Kramer | Cyberpower and National Security: Policy Recommendations for a Strategic Framework[END_REF]. As such, the South African Justice minister, Jeff Radebe, stated at a parliamentary briefing in February 2012 that finalising specific cyber crime plans would be a priority in 2012 [START_REF] Davis | State Security in Charge of Cybercrime Plans[END_REF]. In addition, the DOC stated that its "decision to boost cyber security comes in conjunction with the government's plans to battle crime using technology-based solutions and partnerships" [START_REF] Guy | Cyber Security Policy Will Go Before Cabinet For Approval This Year[END_REF]. With this in mind, the five elements identified above as part of the successful development of a national cyber security strategy [START_REF] Ghernouti-Hélie | A National Strategy for an Effective Cybersecurity Approach and Culture[END_REF] are discussed next, in relation to current South African research.

Political Will

To ensure that the cyber security action plan receives government-wide attention, national leadership is imperative both at an individual and organisational level. Furthermore, national cyber security policies as well as national and international strategies should be in place to fight cyber crime. The draft cyber security policy presented by the DOC aims to ensure that organs of state as well as the private sector can cooperate to ensure the security of South Africa's information networks [START_REF] Guy | Cyber Security Policy Will Go Before Cabinet For Approval This Year[END_REF].

As mentioned in Section 2, the South African national strategy for cyber security is under development, albeit not yet implemented or enforceable. The draft policy does address some levels of compatibility with international efforts, as proposed by Ghernouti-Hélie [START_REF] Ghernouti-Hélie | A National Strategy for an Effective Cybersecurity Approach and Culture[END_REF]. For example, co-operation between police in the Southern African Development Community region and Interpol is a high priority in 2012 to fight cyber criminal syndicates [START_REF] Davis | State Security in Charge of Cybercrime Plans[END_REF].

Adapted Organisational Structures

It is recommended that adequate national organisational structures should exist to support the deployment of an effective cyber security solution for individuals, organi-sations and governmental agencies. These organisational structures should be adapted from other national models to take elements such as country-specific culture, economic context and ICT infrastructure development into account [START_REF] Ghernouti-Hélie | A National Strategy for an Effective Cybersecurity Approach and Culture[END_REF].

In terms of cyber security, a national CSIRT could be the most appropriate organisational structure for linking communication networks and information systems with economic and social development. Earlier South African research has identified nine steps to ensure that the CSIRT meets the needs of such an organisational structure. The first and most crucial of these steps would be clarifying the mandate and policy related issues involved. [START_REF] Grobler | Common Challenges Faced During the Establishment of a CSIRT[END_REF]. At the time of writing, a new move towards the development and establishment of a South African National CSIRT is underway by the DOC and joint partners. The necessity of the National CSIRT is underscored in the draft South African cyber security policy [START_REF]National Cybersecurity Policy Framework for South Africa -Final Draft[END_REF].

Identifying Accurate Proactive and Reactive Measures

Since everyday activities have an increasing digital component, it is becoming increasingly urgent to augment and automate cyber security in order to maximise outputs and minimise human error. Both South African individuals and groups are largely dependent on data. This dependence relates not only to physical data, but also to the relationship of this data to specific infrastructures. Accordingly, it is important that these actions can be both proactive and reactive in nature. Ghernouti-Hélie [START_REF] Ghernouti-Hélie | A National Strategy for an Effective Cybersecurity Approach and Culture[END_REF] proposed that cyber security actors can be classified into three roles: the protector; the protected; or the criminal.

Once the South African cyber security policy is implemented, it is envisioned that the roles would be addressed appropriately, and South African citizens should have a better understanding of where they fit in terms of, for example, who will play the role of the protector, and what is the punishment for the criminals. Existing South African legislation already addresses criminal punishment for cyber security crimes;

Reducing Criminal Opportunities

Due to the international scope of the Internet and wide usage of technology, cyber security intersects largely with the application and implementation of international legislation. Regardless, the foundation for an adequate security strategy is twofold: raise the level of risks taken by the criminal, and raise the level of difficulties faced by the criminal. In all instances, legislative and regulatory measures should concomitantly raise the level of risk perceived by a criminal, and decrease the favourable context to perpetrate an illegal action [START_REF] Ghernouti-Hélie | A National Strategy for an Effective Cybersecurity Approach and Culture[END_REF]. Reducing opportunities for crime is one of the ultimate benefits of implementing a cyber security policy framework. As such, South Africa is one of the signatories of the Council of Europe's Convention on Cybercrime [5].

Education and Awareness

Organisational structures should encourage, lead or coordinate continuing education for professionals in the legal, economical and political fields. In addition, the realisation of a global cyber security awareness culture will contribute to achieving part of the goals of a national cyber security strategy [START_REF] Ghernouti-Hélie | A National Strategy for an Effective Cybersecurity Approach and Culture[END_REF]. In South Africa, there are several cyber security awareness programmes aimed at educating user groups in different geographical areas of the country [START_REF] Grobler | Cyber Awareness Initiatives in South Africa: A National Perspective[END_REF], made necessary by the increasing rate of bandwidth consumption or utilisation in South Africa. Already in 2007/2008, South Africa's overall online activity was estimated to be 67% of overall online activity in Africa, whilst its population accounted for only 5% of that of entire continent [START_REF] Muller | State of South Africa's Internet. MyBroadband[END_REF]. This emphasises the importance of proper cyber security awareness and formalised training in this domain.

Research done in the South African provinces of Gauteng, Mpumalanga and Limpopo in general indicates good Internet behaviour on the part of South African citizens. Completed questionnaires were retrieved from different geographical areas and were grouped under urban areas, semi-rural areas and rural areas. The levels of cyber security awareness were calculated as 69% for urban areas, 53% for semi-rural areas, and 40% for rural areas. A cumulative extrapolation of total awareness in South Africa based on the overall awareness of the sample group is estimated at 51% [START_REF] Jansen Van Vuuren | The Influence of Cyber Security Levels of South African Citizens on National Security[END_REF]. This aspect still requires a lot of attention in South Africa.

The next section introduces the use of an ontology to assist in the development and implementation of a South African cyber security policy.

Using an Ontology to Implement Cyber Security

The mapping of South African research and development activities on the five practical elements as proposed for international cyber security policy implementation (refer to Section 3) shows that some progress has been made. The discussions also highlighted the involvement of a number of entities and functions to ensure the successful implementation of a national cyber security policy. However, since the cyber security environment is not clearly bounded and defined, it is very difficult to put forward an easily understandable and implementable cyber security policy. As such, the authors propose to use an ontological model to formally define and describe the roles of players in this environment together with their functions and responsibilities, as well as the roles of the different stakeholders in the cyber security environment. It is important to realise that there are multiple levels of role players in the cyber security environment and that roles and responsibilities often overlap. It is precisely this layer of complexity that necessitates a structured, formal description of the environment before implementation of the policy can succeed. This ontology will provide a model of the shared environment (i.e. the cyber security domain), a common vocabulary and formal descriptions of the inter-relationships between the relevant entities and functions as identified in Section 3. Ontologies have been used previously to define policy frameworks and instantiate policies [START_REF] Cuppens-Boulahia | An Ontology-based Approach to React to Network Attacks[END_REF]. Although the use of an ontology as proposed here is different to that of Cuppens-Boulahia et al., it is clear that ontologies can be used to assist with the implementation of policy in various ways. Ontologies could therefore be a valuable contribution to the final implementation of a cyber security policy in South Africa.

The methodology of using an ontological model will benefit the communication and sharing of information between role players during the implementation of the policy, the modelling of the implementation phases and functions, and for education and training.

The next sub-section contains an overview of ontologies in general and the subsequent sub-section describes an initial high-level ontology for the cyber security strategic environment.

4.1

What is an Ontology?

For our purposes, an ontology is a technology that provides a way to exchange semantic information between people and systems. It consists of an encoded, common domain vocabulary and a description of the meaning of terms in the vocabulary. Grüber [START_REF] Grüber | A translation approach to portable ontology specifications[END_REF] defines an ontology as "formal, explicit specification of a shared conceptualisation". A formal ontology specifies a machine-readable domain model depicting entities and their inter-entity relationships. It generally consists of a descriptive part and reasoning technologies. The descriptive part of an ontology captures the domain from the domain experts' point of view, expressing domain information in a way that can be processed by computers and be understood by humans. The use of reasoning technologies enables new information to be derived from the facts contained in an ontology.

The information in an ontology is expressed in an ontology language (logic-based language), and then progressively refined. The construction and maintenance of ontologies greatly depend on the availability of ontology languages equipped with welldefined semantics and powerful reasoning tools. Fortunately, there already exists a class of logics, called description logics (DLs), that provides for both, and are therefore ideal candidates for ontology languages [START_REF] Baader | The Description Logic Handbook: Theory, Implementation, and Applications[END_REF]. The Web Ontology Language (OWL) 2.0 was granted the status of a W3C recommendation in 2009, and is the official Semantic Web Ontology language. OWL was designed to provide a common way to process the content of Web information instead of displaying it. It is intended to be interpreted by computer applications and not to be read by people [START_REF]OWL 2 Web Ontology Language: Available from[END_REF]. In this research, OWL was used to interpret the ontological model developed for the cyber security strategic domain.

The use of ontologies is growing rapidly in a variety of application areas, and is the underlying technology driving the Semantic Web initiative [START_REF] Berners-Lee | The Semantic Web[END_REF]. Ontologies vary greatly in their content and intent [START_REF] Boury-Brisset | Ontological Approach to Military Knowledge Modeling and Management. Symposium on Military Data and Information Fusion[END_REF], [START_REF] Smith | The Ontology of Command and Control[END_REF]: upper-level ontologies define general, descriptive terms that are domain independent; core ontologies contain only terms that are domain-neutral, that is, terms that apply to multiple sub-domains; and domain ontologies represent specific terms in a particular domain and are detailed.

A Domain Ontology for the Cyber Security Environment

There are many benefits to implementing ontologies. As such, the authors used an ontological model to identify and propose a formal, encoded description of the cyber security strategic environment. This will contribute largely to the development, implementation and roll out of a national cyber security policy in South Africa. Benefits include:

 To enable the re-use of domain knowledge. There are many role players in South Africa that have performed research and development work on cyber security. Involving these role players as domain experts in the development of the ontology will maximise the utilisation of any existing domain knowledge.  To share a common understanding of domain concepts and information among the members of a community. Due to the dynamic and volatile nature of the cyber security domain, there are often multiple explanations or ambiguous understandings of domain specific concepts. An ontology will assist in standardising these concepts.  To facilitate information integration and interoperability between heterogeneous knowledge sources. As pointed out in Section 3, entities and functions involved in the cyber security domain range from local to international, humans to organisations, and policies to implementation tools. By using an ontology, it would be possible to ensure integration and interoperability between different components of the larger South African cyber domain.  To analyse domain knowledge. Existing domain knowledge, once identified and captured within an ontological model, can be used to finalise the South African cyber security policy, and implement its components to ensure the better protection of National Security and safekeeping [START_REF] Noy | Ontology Development 101: A Guide to Creating Your First Ontology[END_REF].

The main benefit of the high-level ontology envisaged here is that a formal, encoded description of the cyber security strategic environment will be created: that is, all the entities, their attributes and their inter-relationships will be defined and represented. There will be a single shareable model of the environment, agreed-upon by subject experts.

This paper presents the upper-level entities of an initial ontology. Subject matter experts have identified these entities. The proposed cyber security strategy environment ontology is implemented in 'Protégé', a free, open-source platform that provides a suite of tools to construct domain models and knowledge-based applications with ontologies [START_REF]Protégé ontology[END_REF]. The main entities in the environment are the Human Domain, Information, Infrastructure and Tools. Figure 1 illustrates the main entities and their attributes and relationships.

The Human Domain entity consists of either individuals or groups. A group can be public (e.g. a state department) or private (e.g. a company or a terrorist organisation).

A group has the following attributes: size, goal, role, motivation, and it can be regarded as a target.

A goal is an intended outcome whilst a motivation is related to an individual or a group's needs.

An individual shares all of these attributes, but its size is exactly one. Humans use tools, measures, guidelines, policies, techniques, applications, etc. and infrastructure to protect or attack information security and to manipulate information.

Infrastructure can consist of physical infrastructure, electronic infrastructure, or software. Infrastructure has a location as attribute.

Information has a type and format as attributes. Information and Infrastructure have a security classification, and Information has Infrastructure (e.g. is stored somewhere). Most stakeholders have more than one role in the implementation and the application of the policy. For example, DST, the Department of Higher Education and Training and the SSA are jointly responsible for general research on cyber security policy, whilst the SSA takes responsibility for implementing the cyber security policy [START_REF]ICT Procurement: Cyber Security Mandate Transferred[END_REF].

Various centres and civil societies in general are responsible for reporting cyber incidents. When a cyber security incident has been reported or a specific instance of the policy has to be implemented, the relevant stakeholders have to be identified and contacted. The initial ontology can be used to support this task.

Fig. 1 only shows the high-level categories of these entities. However, when analysed in more detail, there is a close correlation between the entities identified in Section 3 and the entities in the proposed ontology. For example, the DOC (refer to Section 3.1) can be classified as a public group with the role of leader that uses the cyber security policy as tool (reactive measures) which uses the physical infrastructure of the CSIRT. Citizens (refer to Section 3.3) can be classified as an individual with the role of protected, and an attribute of target. Cyber security awareness programmes (refer to Section 3.5) can be classified as defence tools (proactive measures) that use physical, software and electronic infrastructure in the location of Limpopo.

Future Research

The first task in creating the cyber security policy is to set up an implementation framework. The first step must comprise an analysis of the current situation in South Africa. The rationale for this analysis is to break down the implementation into manageable, understandable components, because the role players responsible for the implementation are not necessarily the people who formulated the policy. In addition, the output of the analysis will greatly determine the final organisational structure. It is also necessary to be able to determine the strategies that will achieve the identified objectives of the policy. A final organisational structure needs to be investigated and human, financial, technological and physical resources allocated. A change management plan and commitment plan need to be set up to ensure co-operation between the parties involved. The future research will include:

 Development of the implementation framework;  Expansion of the analysis of the current structures and role players of cyber security in South Africa. Several other methodologies would be used including Morphological Analysis, a method for systematically structuring and analysing multidimensional, non-quantifiable problems [START_REF] Ritchey | Wicked Problems. Structuring Social Messes with Morphological Analysis[END_REF]. The detailed domain ontologies will be built using all this information;  Development of organisational structures necessary for implementation of the cyber security policy;  Extension and implementation of the Cyber Security Awareness Toolkit (Cyber-SAT);  Development of change management and commitment plans.

Hence, the use of an ontology is initially envisaged to define the role players and their functions. Later on the authors foresee other uses for an extended ontology. Since the cyber domain environment is vast, a core high-level ontology is proposed to be developed in conjunction with sub-domain ontologies. For example, a sub-domain ontology can be developed for predicting network attacks as a sub-component of the proposed cyber security policy implementation. All the sub-domain ontologies which have been developed can be merged once completed with existing techniques, to provide a combined ontological system that can be further extended.

Conclusion

This article describes the implementation of a cyber security policy in South Africa, summarises progress made so far of the research and development performed, and proposes the way forward. The authors discuss the requirements that will enable the implementation of the cyber security policy and reflect on research that is currently being done on the use of an ontology in this regard. The aim of the ontology is initially to provide a formal description of role players and their function in the cyber security environment.

Although several research articles and projects have been undertaken during the last three years, only limited research has been done on the implementation of the cyber security policy in South Africa. The article by Phahlamohlaka [START_REF] Phahlamohlaka | Cyber Security Awareness Toolkit for National Security: an Approach to South Africa's Cyber Security Policy Implementation[END_REF] discussed the CyberSAT as an implementation strategy. This lack of research could be attributed to the delay in the promulgation of the cyber security policy in South Africa. Cyber security awareness is the only research aspect of the cyber security implementation that has been covered in some detail since 2009, with several players starting to implement some awareness training in South Africa.

  this includes: the Electronic Communications and Transactions Act No 25 of 2002; the Regulation of Interception of Communications and Provision of Communicationrelated information Act No 70 of 2002; and the Protection of Personal Information Bill of 2010 [1].

Fig. 1 .

 1 Fig. 1. Illustration of high-level cyber security strategy environment ontology.


Noora H Alghatam
email: n.h.alghatam@lse.ac.uk

Formatting the Public Sector with ICTs: Exploring Institutional Sources and Processes

Keywords: e-government, global formats, institutions, information systems implementation

This paper discusses the process in which e-government projects are initiated and locally negotiated within the public sector organizations. The issue is explored by employing the theoretical concept of global formats. The concept of formats is employed to explore two interlinked themes: the institutional sources for e-government projects and the processes of locally appropriating these projects within the organizational setting. This paper focuses on an egovernment project that was successfully implemented in one of Dubai's public sector organizations.

Introduction

E-government projects have been adopted in both developed and developing countries as a means to reform the public sector, and as part of a broader objective of achieving social and economic sustainability goals [START_REF] Andersen | E-government Maturity Models: extension of the Layne and Lee model[END_REF], [START_REF] Avgerou | Interpreting the Trustworthiness of Government Mediated by Information and Communication Technology: lessons from electronic voting in Brazil[END_REF], [START_REF] Baum | Gartner's Four Phases of E-government Model[END_REF], [START_REF] Ciborra | Good Governance, Development Theory, and Aid Policy: risks and challenges of e-government in Jordan[END_REF], [START_REF] Davison | From Government to E-government: a transition model[END_REF], [START_REF] Okot-Uma | Electronic Governance: re-inventing good governance[END_REF]. This paper does not focus in particular on the implications of e-government in contributing to development; rather the aim is to explore how the projects that are part of these national initiatives are locally understood, encountered and appropriated by people who work in the public sector. Institutional arrangements play a role in shaping how the planning, design and use of ICTs in the public sector is enacted [START_REF] Coursey | Models of E-government are they Correct? an empirical assessment[END_REF], [START_REF] Fountain | Building the Virtual State: Information Technology and Institutional Change[END_REF]. Similarly, some academics discuss e-government in terms of the historical developments in the public sector and policies of New Public Management (NPM) [START_REF] Cordella | Information Systems in the Public Sector: the e-Government enactment framework[END_REF], [START_REF] Dunleavy | New Public Management Is Dead-Long Live Digital-Era Governance[END_REF], [START_REF] Fountain | Building the Virtual State: Information Technology and Institutional Change[END_REF], [START_REF] Heeks | Reinventing Government in the Information Age: International practice in IT-enabled public sector reform[END_REF]. For instance, e-government is conceptualized as an extension to a history of NPM initiatives in the west [START_REF] Heeks | Reinventing Government in the Information Age: International practice in IT-enabled public sector reform[END_REF]. These initiatives are also considered to be the mark of the digital era governance where information and communication technologies (ICTs) can resolve the problems associated with NPM initiatives of the past [START_REF] Dunleavy | New Public Management Is Dead-Long Live Digital-Era Governance[END_REF]. Adopting an institutional lens explains why there are challenges in adopting standardized systems and models, and why there is diversity in the outcomes [START_REF] Avgerou | Information Systems and Global Diversity (1 st edition)[END_REF]. For example, we often find in the case of developing countries that the ICTs adopted are inscribed with values and assumptions that originate from other contexts, which Heeks refers to as the design-actuality gap [START_REF] Heeks | E-Government as a Carrier of Context[END_REF]. Such mismatches between e-government systems and contexts are also depicted in the work of Cordella and Iannacci who present the case of an e-government project in the justice department in the United Kingdom and Wales. The authors employ institutional theory to explain how implementation involved building on an existing system that was inscribed with concepts from past NPM initiatives and notions of decentralization [START_REF] Cordella | Information Systems in the Public Sector: the e-Government enactment framework[END_REF].

Studies that examine e-government projects from an institutional lens often focus on whether e-government systems have become institutionalized or not [START_REF] Azad | E-Government Institutionalizing Practices of a Land registration mapping system[END_REF], [START_REF] Luna-Reyes | Information Systems Development as Emergent Sociotechnical Change: a practice approach[END_REF]. There is not enough work that explores the nature of institutional interplay and how it conditions the micro-level process of implementation [START_REF] Azad | E-Government Institutionalizing Practices of a Land registration mapping system[END_REF]. There are a few studies that have adopted Actor Network Theory and concepts of improvisations to explore this process [START_REF] Azad | Making E-Government Systems Workable: Exploring the evolution of frames[END_REF], [START_REF] Heeks | Understanding e-Government project trajectories from an actor-network perspective[END_REF]. In this paper, the theoretical concept of formats [START_REF] Sassen | Constructing the Digital Object of Study[END_REF] is employed to explain how semi-configured packages arrive with e-government projects, and how local actors in the public sector work on appropriating them to fit within existing institutional arrangements.

The research question addressed here is: how are e-government projects experienced, negotiated and localized in the context of the public sector organization? The main argument presented is that e-government projects are shaped by interplay between historical developments and the semi-configuration of formats. This combination sets in motion (and conditions) a series of interactions within the organization that localizes e-government.

The paper consists of seven sections. The paper began with an overview of egovernment studies and the research question. The second section introduces the theoretical concept of formats. The third section is the methodology. The fourth section presents an overview of the case study of Dubai's e-government initiative. The fifth section presents the findings, and the sixth a discussion of the key themes that are guided by the theoretical concept of formats. The paper concludes with a summary and key findings.

Theoretical Framework: Global Formats

The concept of formats refers to a semi-configured arrangement of institutional norms, modes of organizing and technology that are (in part) designed by powerful institutional actors and the discourses they engage in. Sassen [START_REF] Sassen | personal communication with author via email[END_REF] identifies these three elements when she states that a format "… is precisely at the intersection of the technology and the organizational forms and norms". Technology is at the heart of these formats, because artifacts bring relevant institutional norms and modes of organizing. It is through this technological component that formats arrive into the organizations and gain legitimacy for adoption and use, mainly because ICTs are associated with transformation, modernization and efficiency gains. As noted by Sassen [START_REF] Sassen | Forward[END_REF], formats require the invention of tools to support their activities and, in the case of e-government, this can be the code, the infrastructure, the work supporting software, or the web portal. The technology component is enacted within organizations and is shaped through use: "…technology is mutant and indeterminate and its potential is performative if other variety of variables are there" [START_REF] Sassen | Constructing the Digital Object of Study[END_REF].

In relation to mode(s) of organizing, international, regional and national institutional actors influence most organizations when they plan, develop and use ICTs. Latham and Sassen describe this in the context of CSO as "…a variety of non-state actors and forms of cross-border cooperation and conflict -global business networks, the new cosmopolitanism, NGOs, Diaspora networks, and trans-boundary public spheres" [23, p. 22, 23]. As the authors explain, the involvement of these actors is understood to be an established hierarchy of scale. For example, in the case of egovernment projects, there are various international organizations or management consultancies that play a role in the practices adopted. The new modes of organizing include working in ways that conform to the best practices such as the stages of growth models and implementation strategies that these institutional actors promote in presentations and publications on e-government.

Finally, the concept of formats incorporates new institutional norms surrounding the development and use of technology. For example, most e-government projects respond to the institution of NPM, which is strongly associated with e-government. Such an institution sets expectations on how the public sector staff perform, specifies the roles of the staff members as they work on e-government, and frames what is deemed to be a successful implementation. For example, it is common in such projects to consider clients who interact with the public sector as 'customers'.

Methodology

The empirical part of this study focuses on the e-government project in one of Dubai's largest public sector organizations for the period of 2000-2008. The empirical research began with a preparatory study in October 2006 that included five interviews to learn more about the e-government initiative and the kind of projects that were being implemented. During this time, interviews were conducted with IT managers from various government departments, the central government organization for egovernment and a researcher from a research institution in Dubai. This provided insight into the developments of the project since year 2000 that included the institutional structures of the state that were set up to plan and manage the e-government initiative. Shortly after that, from October 2006 to May 2007, several visits were made to the main research site, each visit lasting up to one week. The author mainly focused on the e-government section, which is part of the IT department and where the IT managers, system analysts, developers and support officers worked on the egovernment systems.

The research design was a single case study and the data collection methods were mainly based on semi-structured interviews and on-site observations [START_REF] Yin | The Case Study Crisis: some answers[END_REF], [START_REF] Yin | Case Study Research: Design and methods[END_REF]. Following the interpretivist approach to research, the fieldwork was shaped by the interpretations of the researcher in the field as she attempted to capture the actors' perspectives [START_REF] Bryman | The Debate about Quantitative and Qualitative Research: a question of method or epistemology[END_REF], [START_REF] Van Maanen | Qualitative Studies of Organizations[END_REF], [START_REF] Walsham | Interpreting Information Systems in Organizations[END_REF]. The interviews were based on the themes of: the history of the project; the nature of the planning and development activities; the ICT staff's early expectations of e-government; challenges encountered during the project and finally any changes to the nature of operations in the public sector. The interviews were based on a list of questions that guided the interview process to a large extent. However, the nature of qualitative research enabled the researcher to follow up certain themes with questions and shift focus [START_REF] Bryman | The Debate about Quantitative and Qualitative Research: a question of method or epistemology[END_REF]. The interviews were in Arabic or English depending on the interviewee's nationality or preference. The researcher took notes and sometimes tape recorded the interviews.

In addition to interviews, other data collection methods were employed. For example, there were notes taken about the overall work environment, which included the office spaces and work activities of the ICT staff. Secondary data were collected and reviewed during fieldwork to inform the interview process. The researcher reviewed technical specification documents for the systems, job descriptions of the ICT staff and presentations by management consultants. The researcher also read articles published by the central government agency Dubai eGovernment Department (DeG) about the e-government initiative.

Case Description

The e-government project that is the focus of this paper was in one of Dubai's largest public sector organizations, which we will refer to in the paper as The Public Office, abbreviated as TPO. The project is part of a large national e-government initiative to modernize and transform the public sector through the employment of ICTs, and specifically the Internet, in the provision of public services. The initiative was officially announced in the state media in the year 2000 and this set a clear deadline for public organizations to set up 70% of their services over the Internet within a timeframe of a year-and-a-half. The target later changed to 90%. There were two main objectives specified: creating convenience and positioning Dubai as an economic hub for the region. During that year a contract was signed with an international consultancy to assist in the initiative. The consultancy provided guidance in a pilot project to develop four systems and that involved a number of public organizations. Later the consultancy was involved in the design of three institutional structures for the state to plan and manage the e-government initiative, which are: the executive office, Dubai eGovernment and the Government Information Resource Planning Department. Table 1 presents an overview of the role and some of the activities of these institutional structures. Over time these institutional structures took over the planning role off the management consultancy. TPO was faced with the dilemma of limited experience and expertise in web-based technologies and a strict deadline. There was not enough time to learn and work independently on the project, so a contract was signed with an IT and management consultancy that had international expertise in e-government projects. The focus of the study is on the development of the online applications for public services that were to be provided on the web portal, and not the development of back-end systems. One of the first actions taken by the management consultants was to conduct an assessment study of the organization's 'readiness' to embark on the project. Later, they provided a conceptualization on how the project would progress towards the state's deadline. The plan was based on the service prioritization model, which suggests beginning with the simple services first and then gradually progressing to the more complex ones.

The later stage of the model refers to services that require the development of inter-organizational systems to integrate work processes with other public sector organizations. The plan was that the systems were implemented over four phases. The project conformed to the best practice model and plan, and an IT service provider team was hired to work in the IT department to conduct most of the development of applications. The internal team in TPO was expected to work on the support of these services, later taking up a bigger role in the development of applications. It was only a matter of time until bugs were found in the systems that disrupted their operation. The internal team was worried about the situation and in response developed a coding template and checklist to improve the coding process and documentation. A pilot of the new template was developed and presented to IT managers in the department who agreed on introducing it to improve the development process. There were fewer bugs in the systems reported after the new template was adopted in phases three and four. The internal IT team worked on recoding the older applications that were problematic. TPO's system met and even surpassed the state deadline. During phase four, a new project to develop a new infrastructure was introduced to allow flexibility in design. This required additional work in coding the online applications.

Table 1. An Overview of Institutional Structures for E-government in Dubai.

Institutional Structures Objectives

The Executive Office Responsible for formulating the strategy for e-government, and the vision and mission for DeG

Dubai eGovernment (DeG) Promote e-government to the public to reduce physical visits to public sector organizations.

Assist in the simplification of business processes for the development of online services.

Assist the public sector organizations in transitioning towards the integration of databases across different organizations.

Ensure there is a single access point for government services.

Government Information Resource and Planning Department

Responsible for the set up and management of the technical infrastructure for the e-government initiative.

Source: Interview with a former manager at DeG in December 2006 [START_REF]Dubai eGovernment: Dubai e-Government: Achievements and Lessons Learnt[END_REF], [START_REF] Sethi | E-government Implementation: a case study of Dubai egovernment. E-governance in Practice[END_REF] Findings

The Context: History, City Development and ICTs

Revisiting the early phases of setting up of the public administration in Dubai, and the United Arab Emirates (UAE) as a whole in the early 1970s, reveals a series of efforts to build and modernize public systems. It was also apparent that ICTs acquired a significant role in these initiatives in later years. There were numerous investments made in human and financial resources to set up an operable public administrative system in the early 1970s upon attaining independence and the formation of the federation [START_REF] Davidson | The United Arab Emirates: A Study in Survival[END_REF], [START_REF] Zahlan | The Origins of the United Arab Emirates[END_REF]. Dubai's economic activities at the time coincided with one of the earliest efforts in the region to set up a system to support the development of the state and its operations. As the region's social and economic activities expanded, particularly with the exports of oil and industrialization, there was a need to improve the public administrative systems to support this [START_REF] Davidson | The United Arab Emirates: A Study in Survival[END_REF], [START_REF] Fox | The Arab Gulf region: traditionalism globalized or globalization traditionalized?[END_REF], [START_REF] Heard-Bey | The United Arab Emirates: statehood and nation building in a traditional society[END_REF].

In the 1980s there were programs set up with international organizations such as the United Nations Development Programme (UNDP) to provide guidance and consultation to improve the operations of the public administrative systems. The outcome of the UNDP study was mainly in relation to human resource recruitment and training [START_REF] Jakka | Client-Quality Dimensions: empirical evidence from the public sector of the United Arab Emirates[END_REF]. Following on this pattern, there were computerization initiatives for data storage and improving levels of efficiency. The significance of employing ICTs in improving the functioning of the public sector is still present today. The main difference with egovernment in Dubai is the stronger emphasis on the transformation of operations and the creation of a relationship between the public and the public sector that is more customer-oriented [START_REF] Arif | Customer Orientation in e-Government Project Management: a case study[END_REF].

The Arrival and the Acceptance of the E-government Format

The e-government format, which was in part shaped by global discourses and semiconfiguration, was introduced into TPO through three institutional actors. One of the most significant events was the initial announcement of the electronic government initiative in Dubai in 2000. The state mandate for e-government specified objectives for the public sector. They were expected to set up 70% of public services over the Internet within a time frame of 18 months. Moreover, the e-government initiative was framed as a means to make it more convenient for all those who interact with the public sector. Another objective of the initiative was to support Dubai in positioning itself as an economic hub for the region. The emphasis on creating convenience in the public sector is linked to a history of managerial ideas and practices in the UAE. There were various efforts over the years to improve and modernize the public sector since the 1980s by focusing on quality and initiating privatization projects. Second, the e-government initiative established three institutional structures to plan and manage the e-government initiative across the public sector, which were outlined in Table 1. The central agency DeG played a pivotal role in managing the way these systems were developed by providing key performance indicators and evaluating progress based on quarterly reports that were sent to them. DeG was also involved in communicating objectives about the project to various actors in the public sector through presentations. These presentations often included framing expected progress in the e-government initiative in terms of criteria in the stages of growth models.

Third, the e-government project involved working in collaboration with the private sector. The management consultants provided guidance and a plan and the IT service provider worked with them in the development of online applications for the web portal. The involvement of the private sector instantiated and supported the managerial approaches and concepts introduced into the public sector. One of the most significant was the service prioritization model that in essence was based on international best practices.

Localizing E-government

At this point we focus on the process of localizing these systems, which resulted from the actions of the ICT staff in TPO, and which were conditioned by interplay between old and new institutional elements. This section presents three examples of such actions taken by the ICT staff and how they link to institutional elements of the public sector or the new format.

The first example is when the ICT manager registered the e-government project in one of the online competitions offered by an international organization. The action was driven by a sense of ambiguity and the relative newness of these projects, as well as an aspiration to find guidelines on how these projects are developed and evaluated according to global criteria. The act of signing up to the competition shows the influence of international best practices and managerial models in the public sector.

However, there are also examples of the e-government format not fitting with institutionalized dimensions of the public sector. For instance, the emphasis of using standardized models during the planning of the project does not account for local pragmatic concerns of the public sector staff. This was evident when the service prioritization model, which suggests working on simple services first, was not conformed to during the planning of the systems. Instead the managers who were working on egovernment took the decision to go ahead with developing a complex interorganizational system early on. This was because the manual system was a problem that the public and the business community were facing and it needed to be resolved quickly. Another example was the new work arrangements that involved cooperation with the IT service provider that had international expertise and the situation of finding bugs in the system. The internal ICT team in TPO introduced a coding template and checklist to improve the quality of the coding. The semi-configured nature of the format is expected to generate standardized outcomes, and to shape the understanding of e-government implementation. The two examples presented here illustrate that local actors appropriate elements of these formats in ways that come to shape how the systems are developed.

Discussion

The earlier section described key events that took place during the implementation of the e-government project that involved improvisation and innovation during work. This section elaborates on two themes: institutional sources of e-government and the design and shaping of formats. These themes discuss the process of localizing the egovernment systems.

Institutional Sources of E-government

Revisiting e-government formats that arrive in the public sector consists of understanding elements from early generations of e-government as well as NPM. NPM in the west has been influential since the 1970s in the adoption of ICTs in the public sector with the aim of improving efficiency and creating a client culture. Similar trends were present in the UAE, which has initiated programmes to modernize the public administrative system since the 1970s and 1980s that included computerization programmes. As such, e-government initiatives are seen as an extension to the history of automation of work processes to the current initiative to set up web-based systems and the provision of services to create convenience for the public. Yet, there are features to e-government that make it distinct from the previous initiatives. Egovernment emphasizes the theme of transformation of the public sector when it comes to service delivery and relationships with the public. Also, unlike ICT use within NPM initiatives, e-government positions ICT as a central component of change, and not at the periphery. This emphasis on the significance of ICTs introduces with e-government a package of standardized models and approaches to plan, develop and evaluate these systems.

As noted in the previous section, e-government formats that arrive are supported by disembodied institutions that include international organizations and IT and management consultancies [START_REF] Avgerou | Information Systems and Global Diversity (1 st edition)[END_REF]. These institutions provide legitimacy to the e-government project since it is associated with organizational change and socio-economic objectives. In addition to this, local institutions in Dubai's public sector conditioned local actors to accept e-government and took actions that localized the systems. As noted earlier, the ICT staff adapted the service prioritization model and developed a coding template and checklist to meet pragmatic concerns in the public sector. These actions also conformed to the institutionalized role of the public sector as a contributor to development. Thus, the e-government format (the semi-configured package) is intertwined with the historical developments in Dubai's public sector. It came to inform the actions of the ICT staff to localize the system.

6.2

Between the Design and Shaping of Formats E-government projects introduce common objectives and practices to develop and use these systems. Even perceptions of success and failure are defined in similar ways that are guided by best practice models. This is partly from the influence of the private sector and international organizations, which promote similar managerial ap-proaches to ICT projects. These formats for e-government are semi-configured at both the global and national level and thus there is room for locally determining their content to meet local needs and priorities. For example, there are state policies that determine the objectives of these projects, and which element (technology, modes of organizing or new norms) is the central one through which these initiatives are introduced, supported and granted legitimacy. This is illustrated when state policies determine how the systems are to be developed: a new system that is developed from scratch or a system that is built on an existing legacy system, built in-house or outsourced.

As this paper has discussed, e-government formats are also constantly shaped as people in organizations engage with their elements. For instance, some elements are accepted such as the concept of considering the client as 'the customer'. There are other elements of the format that compete with institutionalized dimensions of the public sector and create puzzles that need to be resolved. As the case study has shown, the ICT team adapted elements of the format when they encountered these puzzles and drew upon the historical role of the public sector in development.

Conclusion

This paper focuses on how an e-government project in Dubai was negotiated and localized through the actions of the people working on planning and developing the systems. The paper consists of seven sections. The paper begins with an overview of e-government studies and presented the research question addressed here, which is: how are e-government projects locally experienced, negotiated and localized within the context of the public sector organization? The second section presented the theoretical framework of formats and described its main constructs. The following two sections were the methodology and case study sections that described fieldwork activities and an overview of the public sector in Dubai and the e-government initiative.

The findings section presents a narrative of the developments over the course of the project including an overview of the historical context of the public sector in Dubai and the role of ICTs in city development. The section following this discusses the arrival of the e-government format and its acceptance in the public sector. Finally, the section presents findings within the context of TPO, where local staff encountered the e-government format and took action to localize the e-government systems.

The paper then discusses why actions were taken to localize the systems by drawing on some themes from the theoretical concept of formats. It begins by discussing the institutional sources of e-government in the UAE and then the institutional dynamics that come to inform actions in e-government project. On the one hand, there is the design of formats. On the other, there is ongoing negotiation and shaping of these formats as people encounter new ideas, concepts and artifacts that compete with institutionalized dimensions of the public sector.

In summary, this paper has shown that the e-government format introduced new institutional elements of NPM, and early generations of e-government, into the public sector organization TPO. The public sector employees encountered and appropriated these elements into their daily work activities. In the organizational context, the ICT staff's acceptance of the e-government project, and the efforts to make it work through localization, reflects an ongoing interplay between the historical dimensions of the public sector in Dubai and the new e-government format. As illustrated in this paper, these dynamics are most evident during subtle breakdowns in the project and contradictions that required the ICT staff to resolve them.