for attending and inviting me to speak here at WordCamp Atlanta. It's a pleasure to be back on the campus of Kansas Hall State University. Sorry, I just went right into it. It even stopped for the intro. I forgot. Alright, hello. My name is Josh. I have been extremely online since 1999 and have been building the internet for my career for almost going on 25 years now. So I compiled my first, I picked 1999 because I had done things online before, but it was more like the BBS sort of like online forum era. That was when I started actually making the internet. So I compiled my first open-source web stack which was the Solaris Apache Pearl Postgres stack, the SAP stack, which didn't have the longevity of the technology that we all are here to talk about, but it was interesting and it was somewhat close to what we work with today. My career took a tremendous turn in 2003 when I got involved in a presidential campaign. There was a guy, Governor of Vermont, who was running in the primary and he was a, you know, one percent in the polls, sort of also ran Tandit, but he figured out how to use the internet to organize people, communicate, and raise money and actually came very close to winning. I got involved in that campaign because I liked this message and I had these internet skills so like I could do more for, then like show up and like collect signatures and so forth. So I got involved with like a group of open-source volunteer type folks that were working around that campaign to develop software and technology for the campaign to use and it was like a completely thrilling experience because you could see the way in which what we were able to do online really did matter in the real world and really could potentially have this, from my perspective, tremendously positive impact. For those of you who know about it, the campaign was actually a rather spectacular failure. It crashed and burned and was kind of heartbreaking, but nobody who I worked with on that project went back to their old life. Like you could not unsee what you had seen and so, you know, I got a lot more serious about the work that we were doing. I started a digital agency with some friends in San Francisco called Chapter 3. We were mostly working with Drupal as a technology, but building on the concept of open-source and open web and through the course of that consulting experience, we ended up working with a lot of large-scale organizations on larger-scale web projects and while the customers, the clients were different, the projects were different, the websites were very different, there was a certain amount of work we had to kind of do upfront to put ourselves in place a way of working together and also a way to launch the website that would scale and handle lots of traffic that was really just getting incrementally revised from project to project to project and we took a step back and realized that, hey, that could be a project, that could be a product at its own right. We could turn our expertise into something we deliver as a service and we started a company called Pantheon that was trying to do that and I still work at Pantheon today 13 years later. It was still very Drupal-oriented, but what we did was we allowed people to use version control to keep track of the changes that were going on in their code. We allowed multiple developers to work in parallel without stepping on each other's toes. I'm going to get a little feedback. All right, I'll just keep going and you'll bow me in. Multiple developers to work and also designers and content creators to work in parallel without stepping on each other's toes and a really like kind of push button way to bring all the work in progress together and safely release it onto the production website without there being any downtime or hiccups or issues and that was what we used to do at a pretty pricey rate for these large scale customers on a one by one bespoke basis and we were able to package that up into a software as a service kind of offering with Pantheon and pretty quickly we got a lot of adoption. We had a lot of people like our former selves who are agencies and they loved our product and they kept coming to us and say like guys your stuff is great you have to support WordPress because that's like half my business and like I want to use you for everything and so you know obviously we knew about WordPress. I had a WordPress blog back in the 2003 kind of era of my career and so we looked at it and we're like yeah this is very similar kind of application lamp stack etc. We'll have to like make some minor adjustments. We can basically build the ability to run these websites on our platform as well and so that made perfect sense and we did and you know we kept going and going and going and as of you know a couple years back we crossed the threshold of our platform's delivering websites to over a billion monthly unique visitors. We run a lot of websites and a lot of them are large so they're it's been quite a journey and as part of that journey I've been really really blessed to get to know the WordPress community you know starting a little bit before that 2014 date and I've seen the way in which some of these larger scale organizations are able to adopt and get value out of WordPress and I want to talk about that in the community because it's a little bit different than than how others might be getting value out of WordPress and I think it's a good thing for people to know about and be cognizant of. I was just sitting down in the WordPress education and they're talking about how WordPress is kind of being adopted within the Georgia Department of Education and it's exactly this story it's really exciting to see it happening all over the place so so yeah let's get into it but so first I want to actually just frame this like why should we care about larger organizations right you know I know sometimes there's a little bit of a cultural friction between open source communities and corporate environments and sometimes that can lead on from both sides can lead to a little bit of like people giving each other side eye but I think one of the things that's really crucial within the realm of open source and open source community is like a sustainable community is usually part of an ecosystem that it contains an economy because while a lot of us are hobbyists and enthusiasts those of us who professionalize eventually that professional commitment to continuing to work on a project gives it longevity that if it's just purely people doing it on volunteer time it won't necessarily have and larger organizations can make long-term investments in keeping projects going keeping people employed and you know supporting the long-term health of that commercial ecosystem the other thing is sometimes these larger organizations you'll have access to technical innovation or technology or skills or research and development organizations that you just wouldn't get from smaller actors right like if IBM starts working with a certain technology they're going to bring something to the table in doing that which is just different in necessarily is different than what you would get from a lot of individuals adopting it for themselves and there's there's stuff to be gained there and then finally the core mission of WordPress to democratize publishing is an incredibly vital mission within larger organizations like I don't know how many of you have worked or worked with people in big companies but particularly if you're in a larger organization that's been around for 20 or 30 years like they already have a bunch of web stuff because the web has existed that long and I guarantee you that web stuff if it's probably not WordPress and it's probably pretty bad and and that mission of democratizing publishing that's for everyone like people who work at big companies deserve to have good publishing tools too so that's my pitch for why the WordPress community should feel good about getting more tightly ingrained with larger organizations. Now why do large organizations care about WordPress? Well picking up on what I just said the ability to adopt a modern easy to use widely supported cost effective technology to revitalize their web interface is a tremendous win for these organizations across many fronts. There are a lot of larger organizations you know we're not talking about the fresh new startups here we're talking about bigger institutions, larger companies and so forth they have had web stuff for 20 25 sometimes 30 years but what they need from the web is changing because it doesn't matter whether you're thinking about constituent services or you're trying to like keep your customers loyal or you're trying to grow your business the touch points companies have with people are now almost 100% digitally mediated and when companies communicate with individuals they're usually increasingly doing so with the idea of someone taking action they're not just trying to get them to look at an image or well they are right people do advertising and billboards have a place in the world but increasingly the communication between companies and and the people out there or inside the companies are ones that are have an action associated with them there's a call to action in marketing speak and calls to action or clicks and clicks go to the web and if the web is this legacy lumbering not usable off-brand dysfunctional behemoth it's very very hard to get anything done and so if you think about the the the work of any of these personas you know designers content editors marketers people even people in IT right if they're dragging legacy technology behind them it's very hard for them to succeed at their jobs and if they're not succeeding at their jobs the organization will fail at its mission so large organizations care about WordPress because it can in many cases not every case but in many cases be a way for them to get out of decades of technical debt and establish a fresh start on the web at a time when the web is an increasingly vital asset for them to achieve their mission because if you have to if you want to win online you have to move fast you have all these other things that are driving engagement like i was talking about before and it's not just digital engagement i mean who anybody here watch the Super Bowl because like every other ad had a if they didn't have a QR code it had a like a web URL where they're like they were like go type this into your phone right now it wasn't like branding like al.com is there it was go to uh you know company.com slash Super Bowl to claim your free trial like because they know i'm watching tv and i've got this device and i can do two things at once and so if the thing that you're trying to drive people to and increasingly it is with this device is not up to speed it's out of step you're going to be wasting all that that Super Bowl money and nobody wants to waste the Super Bowl money because it's a lot it's not cheap the speed at which people can move though is just it's it's really not there like again we commissioned some independent research on this uh at at Pantheon last year as surveying over 450 um uh leaders in uh in corporate marketing it and over 80 percent of people reported that it took them a week or more to make a change to their website now this is not just because of technology like the challenges usually are people process and technology so in many cases this is uh because there's a process around making changes to the web which dates back to a concept of the web as like your their company's website is like the crown jewel of your brand empire and you build it once with like the most amazing design firm with guys with just the hippest classes you've you've ever seen um and they they get it perfect and it's beautiful and it's there and you would never move a pixel on that website without going through seven layers of approval um that was how a lot of larger organizations conceived of their web presence not that long ago some probably still do today i mean i remember at uh at a uh a really interesting conversation with a really hip guy um in oakland at uh huge which is a big global digital agency um and i was trying to talk to him about the way that i work on the web and he was like this is really cool but i don't know if there's much for us to do together because i work for Toyota and Toyota's website Toyota.com is a masterpiece that will never be touched until it is entirely re-conceived uh and like that's how they they think about it well and in fairness like at the time this was like in 2015 too so they're not really wrong right because Toyota.com is not where you go to buy a car it's where you go to learn the story of Toyota the brand and you know um uh a lot of this stuff a lot of the reason for this slowness is there is like you know in some cases i actually think for the Toyota.com i asked him there is no cms it's all it was just static HTML at the end of the day what they produced uh because again it was like a it was a perfectly delivered artifact um so you know so that's that's both people process and technology in some cases you just just have bad technology it could be bad like really poorly implemented WordPress like we've all seen it right like we're not trying to throw anybody under the bus we've all seen those builds that are like okay so i need to post some content let's let's you know if you like and in organizations that have one of those kind of wonky idiosyncratic cms implementations there's like one or two people that actually know how it works and they're busy with like 17 other things too so it just kind of goes into a queue and when they get to it they get to it or like this is like you know older enterprise uh cms is like vignette and so forth have this problem in spades where it's like we file a ticket with it to change the copy um and then there's other cases where it actually really is like you know just like teams are online like people will just bicker about what change to make and like the technology is not in the way they could do it anytime they wanted to but they can't get on the same page regardless this is not a recipe for success given everything we just talked about about the the importance of velocity and yet it's something that a lot of large organizations have just kind of like they've gotten beaten into submission on this there's a kind of a stock home syndrome that takes on uh takes takes hold when it comes to the web where people are so used to it being just lagging behind and oh kind of broken and uh we'll get to it next year um you know and I think the uh the increasing awareness especially in these enterprise organizations that there is a better way that you could really democratize publishing and it would be a good thing to do is uh is important I think it's going to actually make a lot of people not just more successful but a lot happier um and there's a specific kind of tension that comes into play with a lot of this stuff uh in large organizations um and this is where you get into like the classic I'm going to oversimplify for the sake sake sake of drama and narrative but it's the classic conflict between marketing and IT where you know the IT people in an organization they have imperatives around stability security compliance that are non-negotiable right you you cannot say well we're just going to run something insecure because we need to because you're not going to win that argument but on the flip side the traditional ways in which IT has usually gone about achieving those imperatives leaves the the people on the on the on the on their partners in the business side often in marketing kind of hamstrung right they cannot they cannot move fast maybe they have one of these systems where they can't even self publish um they they the the practice of modern digital marketing has is unrecognizable today compared to where it was a decade ago there are so many new tech technologies so many new channels so many new touch points and and the people on that side of the fence are often you know again they have like one hand tied behind their back because they're like I can't use that I can't use that because if I want to even pick that up it's a two-year procurement cycle or this over here will never I don't mean that they're just going to shut me down and it actually can result in a very unhealthy dynamic you know large organizations inevitably contain politics it's not possible to have like hundreds of people working together month or month year-over-year without like groups who emerge that have opinions about one another it's this work this is our wire to this species you're not going to be able to solve it and and the this this dynamic can often like lead to like a pretty toxic environment and so again like I think it's a great thing for us to think about how open-source technologies like WordPress can actually come in and be a chance to reset this relationship so we did some more research that I want to share with you and then and then I'm happy to take some questions this was an additional so the first survey we did was actually last summer it was just like a how messed up is your situation basically and there's more more details in that this one we started to look specifically at attitudes towards WordPress within enterprise companies and there's there's there's good news and and room for improvement let's see so so I was actually surprised to find that 92 percent of those we surveyed in enterprise organizations had a positive impression of WordPress I sort of had this presupposition in my head that people like we're like you know WordPress is Tinker Toys we can't use it here it's it's insecure or whatever but I think actually the truth is a lot of these people have had direct experience with WordPress outside of their day job and they know it's actually pretty good so it's widely known and widely liked and 80 percent of them said WordPress is enterprise ready which you know that's everybody has their own definition of what enterprise ready means but but that seems to be like a positive signal from can WordPress find adoption within these organizations or is it just going to get like blocked at the door now only 34 percent of that though strongly agreed with that statement so there are a lot of people that were kind of a little bit wishy washy in the middle like well is WordPress enterprise ready I somewhat agree with that I'll get into some of the reasons why in a second but that's one of the key areas of opportunity I think for those of us who work in the space or who want to work in the space to focus on and 60 percent of them currently use WordPress somewhere in some capacity and that's another piece that we'll talk about because the the way in which WordPress gets adopted is you know there's a kind of a maturity model that goes along with that in in these larger organizations but this is like good initial findings the recommendations sort of that the survey company put together for for us around this were you know to focus on how WordPress the first piece was to focus on WordPress connects into other really important systems like CRM how it can be customized to meet people's needs how to do governance with WordPress how to keep track of multiple sites and oversee things that's a really big important imperative and the the takeaway was you know people know about it people like it but they know that it doesn't do everything and like yes there's a plugin for that but there a lot of the plugins are not necessarily designed to integrate with these enterprise systems so there's like a there but there are actually a bunch of them like there's a really good Salesforce plugin for example and so you know that but that might not be as widely known another key thing was again highlight the fact that you can make really great websites for these devices on WordPress too that's something that like enterprise organizations are increasingly realizing they're like behind the eight bond so y'all remember responsive design and how that what the truth is that is that was not a really great answer because responsive design is a incremental step of well the website will not look entirely broken on your phone if you choose to wait for it to load which is a step up from like I can't read the you know like this but the reality is that over you know I think over 50% of even in the US web browsing is done from mobile devices now and there is a significant difference in the outcomes you get if that's a big part of your traffic and not everyone is when you have a website that's optimized for a mobile device versus one that's simply responsive when it's loaded on a small screen so that's one thing you know then there are other other pieces they said you'd kind of have to figure out how to talk about alongside WordPress which is like again speaking to some of those IT considerations around disaster recovery you know security how do you how do you make it all scale and so forth you know to be considered an enterprise grade CRM you would need those would those would sort of be table stakes type type questions that people would ask and yeah I sort of cover that in the third piece as well so this all it's this is not terribly surprising to me this this makes sense like the the through line is you know on the IT side you were going to need to shore up WordPress and explain that it you know even if you have a positive impression of it you probably want some additional assurances around security you want to know that you can handle the scale of the the project that you're taking on and how you're going to address that and on the business user side you know you want to like really hit home that there's like real value in building digital experiences this way because it you can meet the the expectations of modern digital natives consumers and constituents and also that like WordPress is a great way to tie together all these other pieces of technology that you're also working with and then this to this other point about how enterprise adoption happens it doesn't always happen in this linear path like it's you know technologies goes through a journey inside a large organization but this is a I've been oversimplified for the sake of creating a simple narrative you know WordPress will often start off as a as a point solution right it's a it's the classic use cases people still just turn to it when they need a blog why not it's great blog or but it's or it's some kind of microsite right like in the Georgia Department of Education story that they were talking about downstairs it started out as a community forum as like a you know quick quick let's get something up and running because we just had to shut down all the schools and the teachers need a way to talk to each others that we can verify is real and and share best practices so point solution around a community forum they got that up and running in a matter of weeks and and it worked wonderfully for them now and I swear I didn't plan it this way they're they're talking about being in the midst of relaunching the main Department of Education website on WordPress it's currently running on SharePoint so they need to do something but you know SharePoints serve them well I don't want to just bad mouth SharePoint but this is usually the next step there's like you get to this notion of like we have an enterprise CMS which is you know we feel like we can put flagship main brand properties primary domains and run these big websites important websites on WordPress and there's another stage beyond that that I'm going to talk about a little bit more because this is what I think is really interesting for people who are you know people in the community people you know whether you're a plugin developer or you're an agency person or someone else what I've seen happen is organizations take this journey and move on to the point where they no longer consider where they're thinking about WordPress as an enterprise wide platform they're not thinking about individual websites anymore they're thinking about we use WordPress to solve problems and so this means leveraging WordPress across many projects and often in larger organizations through many different teams and it's a really interesting and I think really valuable implementation of open source technology you kind of think of it like if you're a Linux person this is like these enterprises are building their own WordPress distro and then making use of it internally across a number of different projects and a number of different stakeholders and I have an example of a customer of ours that did this it's a company called Pernod Ricard they're a headquartered out of Paris but they have a it's a holding company that owns I think like 250 alcohol brands including a bunch of brand names like Absolute Vodka and so forth and they we started working with them a like a while ago I think it was 2015 or so so forth and they were at that stage in the in the state that a lot of large companies are where you know a lot had happened they had been growing really fast they've done a lot of acquisitions and as a result of that they had this like totally chaotic landscape of technologies and they also had this world where the central IT team that ultimately was the bag holder for all of this was not empowered to set standards or or provide guidance like they they have you know all these different brands and sometimes even the same brand within a different geography would just go out and hire their own agency because they have a campaign coming up and they need this website up and running and you know if you're you can't tell me no I'm just going to go do it because the dynamics in the business were such that IT just didn't have that kind of that kind of power it was more decentralized and so they were just really stuck because they would they had the all like this this total cluttered pile of technologies and they were constantly getting new things thrown over to the wall at them because you know it turns out that Valentine's whiskey took off like a rocket in Poland and somebody local built 10 websites to support the different campaigns they did around them and guess who owns that forever them and so we started working with them on developing a a web platform that they could use to you know not only to rationalize their existing project portfolio but to get ahead of the needs of other people in their organization to say look you're gonna you want a campaign site here's how you'll do it we use WordPress in this way it comes preconfigured with all this stuff we know how to maintain it long term and you know over the course of many years this is not like a project that happened overnight but they got this really really great kit together and you know the central team now has like you know two engineers that are supporting 225 plus sites and they're happy about it and they are working with all these other little stakeholders in the organization and they can get a new campaign site spun up in an hour and it's been a it's been a tremendous success story for them that this is a quote from the the leader of the guy who helped this transformation take come about you know talking about how he arrived at the decision to go down this path you know WordPress came out as a winner due to its affordable costs the ease of content management and the agency partners experience expertise and experience our goal is to be flexible to different development styles we didn't want to end up in a situation where the platform was unpopular amongst our many global agencies and teams so they they were able to strike a balance with WordPress where they had some amount of governance over the things but they also let the all the stakeholders do their own thing to a certain extent and I can tell you you know having worked with Ian for for years like like the mistakes were definitely made along the way it wasn't perfect but it was so much better so much better than what they were dealing with before and that would not have been possible without you know the ability of you know the the open source sort of core CMS to you know it's it's not just actually the open source that's the other thing it's great about WordPress I didn't I sort of alluded to in the why do large organizations care about it but the popularity of word press and the wide availability of expertise and talent around it is a huge selling point especially when you consider that the other solutions that most of these organizations are considering are like enterprise only software that there's like 500 people on the planet that know how to implement and 429 of them work for Accenture it's like it's tough right you're like oh get in the van will it get your implementation plan going and this is what I'm talking about these DXPs this is what the the category is called in the industry they're not really delivering the goods like this was something that really came up in the mid the mid teens and it was the based on this notion that there would be these all-in-one vendors that would give you everything you needed for your web experience and that's not a was not a silly thing to predict because it had happened in other software categories before like you know you look at what Salesforce did with with CRM and that very successful doing that but there's two two things I think that are different and really different about the web in the world that we inhabit which is one we're talking about user experiences at the end of the day user experiences don't want to be commodified if you're thinking about your CRM and how you internally operate like your customer service or your sales team you kind of actually do want that to be commodified you want it to be the same you don't mind if it's the same as like your competitor because like you want to be able to hire someone and like have them know how run the software right off the bat and there's like best practices for how you do all those things that like you know you could tinker with a little bit but it's mostly you just have to out hustle ahead of their strategy than someone else when you're talking about how you present yourself your organization your custom your your company to the world you don't want to look like everybody else you don't want to be you want to be differentiated differentiation is how you get a competitive advantage the other thing that this the this perspective the dxp perspective totally missed was the like the martech 10 000 I think like at the time that the dxp emerged as a category there were it was the martech 2000 or the martech 500 okay wow uh scott drinker and he really caught a tiger by the tail there um so and it's 10 000 now like the opposite is what happened there was a cambrian explosion of technologies as I mentioned before because there are always these new channels are emerging new behaviors are emerging and new technologies emerge to allow companies to try to capitalize on those opportunities so the exact opposite of the consolidation happened and so you have these companies that tried to build these all in one suites that they they're some of them they have good software but the the the the paradigm they were trying to build toward was just fundamentally misaligned with the realities of what people need in the market and so you can see it's like kind of starting to show up now as people are going through renewal cycles and saying do I want to do this for another five years and they're more and more often saying no or I wouldn't recommend it and open source vendors are starting to see more you know more positive uh referrals so I guess I should have explained that it's playing the graph too so this is uh data taken from the Gartner peer insights forum which is a publicly available uh review site that caters to enterprise users so um you can go in there and look it up and check it out yourself and check you know check your favorite vendor and see if they're on there and you can compare people and stuff like that it's kind of cool but if you just get the raw data and um and uh and graph out um credit to null talk for for making this graph and posting on linkedin so I didn't have to um so this is our perspective and I get getting back to the the um my professional view on this which is there was a notion that large organizations would buy these monolithic suites from individual vendors that's just not turned out to be very very good it hasn't worked out for a lot of people instead I think we're living in a world where you need to be able to compose a stack compose of you know open source technologies and SAS technologies it's not going to be all open source all the time um for most folks because it's a lot of overhead to manage um and you know I see wordpress Drupal still uh uh used in a lot of cases and I see that the the rising generation of front-end technologies I think I've seen next jas mentioned like five times just at this camp um they've got a really really awesome uh approach to delivering even more zippy experiences especially for these kinds of devices um I think the future is going to be in companies figuring out how they're going to put together the right uh the right stack of technologies for them to do what they need to do uh and I think wordpress is it's not quite quite like position that way in the graph but like the the CMS the content management system really is one of the most important hubs in that type of implementation and uh and I think you know uh for for enterprises and and larger organizations wordpress has a ton of value to offer in that context and with that I will stop monologuing and happy to answer questions that anybody has yes early you talked about your own personal view wordpress back in the day what gave you that impression uh so so the question was uh I talked about um my own perception of wordpress back in the day and what gave me that perception um so I would say it was um primarily driven by my own experience with wordpress in like circa 2002 2003 actually I I had a BB press blog that I upgraded to wordpress um and that was just you know you work with the technology once you just kind of that's that's the the data point you have in your head and then I will also say and the this is something that I actually changed a lot and that's great the like sort of like well uh we don't need to support the latest versions of php because we're wordpress and with the rules like I don't want for the kind of misalignment between php and its progression and wordpress that was happening in the later aughts um that also I think contributed to my perception that was like maybe not ready for prime time um fairly or not I think those are both data points that put that in my head happy to say that's all been resolved yes they have to do these adjustments and changes and go through testing and everything can you speak to again to those concerns about that very secure information and I have to have it where the changes are come up successfully in an audit to you know CYA shall we say um when the um regulators come in and the software changes and the scrum teams process yeah yeah so the question was can you know thinking of uh the needs of security in uh industries like finance insurance and healthcare where there's like very very sensitive information um and also um the the reality that the um even when you know engineering teams are using best practice agile methods like that the the overhead of maintaining compliance with that type of security process is one of the reasons that some of that software might move slower so it's kind of like speaking to security around information and also how security fits into um a development practice there's two slightly different questions um in my experience I would never recommend using WordPress to store PII I would I would steer as very clear of that as a use case I mean I should say sensitive PII because if you're going to have user accounts there's going to be email addresses in there and you kind of have different grades of PII it's just not a it hasn't been engineered with the notion of uh that type of uh information as what it's keeping track of um you know you would you would want and and this is why in that kind of like diagram of the composable universe um there's uh uh you know we uh just about to publish a uh uh Boston healthcare uh the the hospital associated with Boston University case study and and their whole point was we have a stack of technology that's for our web experiences that are public facing and then we have EPIC which is where all it was our patient portal which is all of our patient touch points and we keep those very very segmented and the handoff points between them are carefully managed um so so really there's like on the on the one hand I would say sometimes people think about this and like oh we can't use WordPress because we have you know um this type of information that you wouldn't necessarily want to keep there and the answer is like well you usually have multiple systems when you're doing with that type of information and I guarantee you that your EPIC is a terrible way to represent your organization to the public and inform them about things so you can you work with both and then to your point on scrum teams and you know security testing and auditing um yeah this is something that we this is like this is kind of my bread and butter as a uh a business person is trying to help bring WordPress development teams up to a lot of those standards because you once you get a good dev ops kind of pipeline going then you can layer in that additional sort of the dev sec ops like it's the automated security auditing the the code snapshotting the ability to uh to to provide like a chain of custody for every change that was made to the functionality of the website and then on the WordPress side uh from that standpoint when you're thinking about you know some of these demands are actually made of content teams so like my my wife works for a pharmaceutical company and for certain things that they put on the website they they have the similar requirements because they're making representations about drugs um and that's not something that that's not something you would necessarily that that's one of those cases where it's good to have those extra layers of checking before something goes live but you can build all like that's all just a matter of like you know roles editorial workflow and an audit log of who published what when and then like those are things that you can do in WordPress pretty easily and that like you know just have to you have to understand like are you working with high velocity content or are you working with like you know very content you might be really careful about and usually most again it's a mix right you're not always publishing the list of side effects for a drug sometimes you're just trying to get a post out in response to some something that's happening in the news or you know take advantage of uh something you know in a more marketing context i hope that answered your question yeah it can be hard when organizations are are used to um organizations still have a very monolithic mindset of like it the web has one there's one tool that does all web and it's like that that was true when there was a webmaster and that tool was like tooling html on the server it's like now you're gonna have lots of tools to do your web stuff um but they'll they'll they'll catch on eventually i'm sure yes yeah um so following up on the first part of that question and sort of going down to the in a world future projection we've all seen the experience of a perfect example of the chinese wall between pii and medical could not comply with the stuff and marketing information and it's been a complex where you're like right keep that chinese wall and then every once in a while we want to try to tie a record more and more some of our problems are saying we are going to do integrations with this composite stack where this wall has started to become a course do you see a future where and companies like this over hosting in general will have to start looking at creating data structures that are more fluid for this composite stack because even in your given you some context even in your slide where you show how composable the platform is clients want source of truth so let's take out the best stuff and say if you just want to grab some stuff it's not so good but firmly agree it so it's available to those other components you need a place to do that like the data library so this group of databases is not organized that's something that you think posting companies like and you know made so paraphrase the question and tell me if i got it right in a world where as as always happens like those clean lines of separation are the business has reason to want to pass information back and forth or match records across those clean lines of separation is there a role for platform providers or hosting companies like pantheon to play in helping to make that happen I would say no and the reason I would say that is the sorts of organizations that really have so there's there's cases where you have that need and it's pretty lightweight in which case there are like customer data platforms are already a thing and they already help with all this stuff and they're really easy to implement and like I wouldn't I don't want to I don't think we're going to get into a you know competing with segment as a as a way to start to to to tie some of these things together and in cases where the use cases is like more significant and material I'd much rather partner with Google Cloud Platform on feeding data out of the publicly facing website of the sphere into a data lake that they're the company is building on top of BigQuery or something else that already exists and I see it as more of a way of in both of those cases the role that I think I would play or we would play is in helping to like architect the integration correctly and potentially guide people to the right partner so typically in the so wouldn't you come to us for doing that we would get the conversation started but the reason why larger scale organizations want to approach that type of model is it's their Google data lake they don't want it to be pantheons they want it to be owned by them and Amazon does similar things we just aren't partnered with Amazon so like the idea is you you you you create a secure way to pass information from the pantheon managed sphere of or WordPress managed sphere doesn't be on us of of data into a separate partition within the Google Cloud Platform that's owned by the customer and so like it's really their data at that point and and we're just helping to make sure that it gets dropped in the right place yep other questions awkward zoom length pause thank you very much


Welcome to the Justice Committee's 1915 meeting of 2017. Liam McArthur has indicated that he's been delayed at Kirkwall Airport but hopes to join us later this morning. Agenda item number one is consideration of the criminal finance bill legislative consent memorandum. This is a supplementary memorandum as a result of amendments to the bill being tabled at Westminster. Our aim is to report to the Parliament on the supplementary memorandum in time for the relevant motion being taken. We understand that the motion will be taken at decision time this afternoon, so obviously time is extremely limited, but we'll do what we can in that time to scrutinise it. I welcome Michael Matheson, Cabinet Secretary for Justice and his officials. Linda Hamilton, Deputy Director, Defence, Security and Cyber Reliance, Alistair Creeror, Head of Organised Crime Policy and Craig French, director of legal services with the Scottish Government. I refer members to paper 1, which is note by the clerk, and I invite the cabinet secretary to make a brief opening statement. I'll try to keep my introductory remarks brief. First of all, I'd like to explain the exhilarated timescale that we are now find ourselves working to with this particular LCM. The criminal finance bill has always had a tight list of timetable, and the Prime Minister's decision to hold a UK general election on 8 June has forced the process to be expedited further. While that may be unsatisfactory, the Scottish Government is keen to see the provisions in the bill apply in Scotland and the support of the supplementary legislative consent motion being agreed in line with those exhilarated timescales and in advance of dissolution of the UK Parliament. The bill is intended to strengthen the capabilities and powers that law enforcement agencies and partners have to recover at the proceeds of crime, tackling money laundering and corruption and counter-terrorism financing. The Scottish Government shares those objectives. Indeed, in our programme for government for 2016-17, we committed to pressing the UK government to strengthen proceeds of crime legislation, including enabling the police to seize betting, slips and casino chips from criminals. It is good to see those changes now being delivered. The committee has previously considered and reported on the original LCM, alongside my letter to you of 20 January and 24 February, and Parliament voted to pass the original motion on 2 March. The supplementary LCM sets out relevant amendments that have been tabled since my letter of 24 February. That is probably a good moment to confirm that the possible amendment to clause 51, which is now clause 53, the power to make consequential provisions, which I referred to in the supplementary LCM, has now been lodged by Home Office ministers and will be considered by the House of Lords today. In addition, amendment 2, part 10 of the Proceeds of Crime Act around information sharing, which was flagged up in my letter of 24 February and, again, in the supplementary LCM, has been expanded to include information sharing about two additional aspects of civil recovery—recovery of listed assets and forfeiture of bank accounts. I now make it clear that the Proceeds of Crime related information can be shared with HMRCS, HMRC and the Financial Conduct Authority. Those amendments, like the bill as a whole, are intended to further strengthen and improve the recovery of the Proceeds of Crime, and I would encourage the committee to support them. I thank the committee for agreeing to consider the supplementary memorandum at such short notice and helping to ensure that a vote can take place in Parliament this afternoon on the supplementary motion. John Finnie Good morning, cabinet secretary. Cabinet secretary, I have some very positive enhancements to the position that we were in earlier. Can you comment, please, on the Magnitsky amendment and how it is likely to manifest itself? Clause 12 of the Magnitsky amendment, which is included within the criminal finance bill, was voted on on 21 February. The amendment intends to allow for proceedings to be taken forward here within Scotland of the UK against an individual who may have been associated with breaches of human rights in another country. For example, if they have been involved in a process, it is involved in the abuse of human rights in another foreign country, and they are living here in Scotland or elsewhere in the UK. Their lifestyle is not reflective of what we would expect someone, given their tax returns in this country, to allow law enforcement agencies to be able to take action against them and to pursue those assets, given that they may be associated with the abuse of human rights in another country. Can you comment on the level of co-operation between law enforcement agencies and between countries, as well as is there any threat with Brexit? I do not think that this will be a matter for Brexit in itself, because the original part of this comes from a piece of legislation that was introduced in the USA, if I recall correctly, which followed the whole principle of the Magnitsky amendment. That is individuals who were involved in what we have seen the abuse of this individual's human rights in Russia, who had assets in other countries. The fact that they were held in other countries, in this case America, allowed American law enforcement agencies to pursue those particular assets of individuals who they believed were involved in the abuse of his individual human rights. It is not a case of co-operation from another country that will allow our courts here to make a determination on that based on the information that is laid before them and the assets that are held here in Scotland or somewhere else in the UK. In an entirely Scottish context, would you envisage that the Crown Office Procurator Fiscal Service Police Scotland would laze with organisations like Amnesty International, Human Rights Watch, to perhaps initiate inquiries? I have got no doubt that they would use a whole range of different stakeholders in order to draw together an evidential base around concerns relating to an individual and where they have been abusing someone's rights in another country. That would then be brought together and would then be for the Crown Office to determine how we would then take that forward. I will ask Linda Hamilton to maybe just expand in the process that the Crown Office would use, given that Linda was previously at the Crown Office and dealing with some of those types of issues, but it would use a range of different information sources in order to put together a case that they could then take forward in the courts here in Scotland. The cabinet secretary is absolutely right on that. The Crown Office will laze with international partners, as will Police Scotland, as is required to get information from that state, should it be required for the purposes of the investigation. What the unexplained wealth order does do is allow further investigation, strengthens investigation powers, if, for example, that country is not willing to share information. You can imagine that more hostile countries, if there have been human rights abuses, may not want to share information with Crown Office or Police Scotland, so the UWO powers just strengthen that and give a stronger investigative tool in order to get information collected at a Scottish level. On your Brexit question, the negotiations are very important in terms of making sure that Scotland is in at least as good a strong position as it is now in terms of investigations abroad and working with international partners. Would that require a conviction to initiate that particular aspect? No, it will not require a conviction that is civil based. Technical point about timescale. I understand that it is proposed that House of Commons be dissolved on Wednesday next week. I would be interested to hear whether we have had assurances from the UK Government that they expect to complete the process on this bill that is before the UK Parliament, before dissolution. We have. I wonder if Paragraph 17 of the supplementary LCM provides for the payment of compensation if property is wrongly frozen in relation to an explained wealth order. Compensation would be paid by the Scottish ministers. Under the Proceeds of Crime 2002, is there a provision for Scottish ministers to make compensation payments for wrongful orders? How much does the Scottish Government typically pay out in compensation per annum? Those provisions are similar to the provisions that we already have in the Proceeds of Crime legislation, so it is a similar provision that is created. What would happen is that the individual would have to show the loss or the serious default on the part of, in his case, a Crown Office or the Scottish ministers in pursuing the issue when they applied for an interim freezing order. That is a process that we already have in place for the Proceeds of Crime legislation. It will be similar for this legislation as well. It is not a new process extending that process into this particular area of legislation. Do you have an idea how much Scottish Government would normally pay out in compensation per annum? I do not have that to mind at the present time, but it would have to be a matter that would be raised in court by the applicants themselves. I do not know where Linda can expand on the extent of which that happens. The compensation provisions that exist in the Proceeds of Crime act already are there to protect people whose property has been wrongly frozen. They are very rarely used. People will ask for compensation sometimes, but the courts will decide whether that is appropriate or not. It tends to be that arguments may be made around good faith or may be made around whether the state has acted properly. Just because somebody has their property frozen and that property is thereafter shown to be legitimate does not necessarily create a case for compensation. Another intriguing bit of the LCM was—I wonder if the cabinet secretary could expand on the comments in paragraph 18 of the supplementary LCM about the increasing sophisticated ways in which criminals try to prevent the recovery of criminal gains, including the use of betting slips. Yes. As you can always imagine, individuals who are involved in this type of activity will seek to try to identify ways in which they can circumvent the existing provisions that we have in the Proceeds of Crime. Originally, there was provision made within the particular bill to include casino chips, because that was being used as a way in which to try to circumvent the Proceeds of Crime regulations that it stands. The former Lord Advocate in Scotland raised the issue of betting slips being used. Those fixed odds betting terminals tick it in, tick it out processes that were being used as a way in which it is almost a way of laundering cash. It has been identified by the Crown Office here in Scotland as an area where they had grown concerned that it was being used in order to circumvent the Proceeds of Crime legislation. That is why I raised the issue with the UK Government as a need for us to make sure that we close down that loophole and the amendments that have been brought in will assist us in doing that, which will now allow those issues to be pursued through the Proceeds of Crime process in a way in which we can for other areas where we are trying to pursue those types of assets. It is an example of the way in which individuals who are involved in that type of criminality will always try to find loopholes. We need to make sure that we continue to close them down as and when they arise. It was particularly interesting having met representatives from the gambling industry, just how alertly we are and aware of the possibility of laundering and the kind of measures that they have put in place. I was intrigued to see what that referred to. Finally, for the avoidance of doubt, is the Cabinet Secretary and his officials quite satisfied that you have had sufficient time to look at the provisions in the supplementary LCM? I think that it would be stretching it to say that we have had sufficient time, to be perfectly frank. It has been very difficult to deal with this piece of legislation because of the very constrained timeframe that it had from the very outset. Although we have been working hard with officials at the Home Office around the areas that we have been looking to have addressed, it has been a challenge in time frame. It is certainly not what I would hold up as an example of how things should be done between the two parliaments. That has been added to further as a result of the calling of a general election, which has constrained the timetable even further. I suppose that the main point is that you are satisfied that the powers that are appropriate and sufficient will be legally robust, even in the shortened timetable that you have had to look at the provisions. As I said in my opening comments, the reason that we want the committee in Parliament to support the particular supplementary LCM is because the provisions that are being taken forward, which require the supplementary LCM, are very useful to a law enforcement agency in Scotland. Although the process is not a good example of how it should be done, the benefits that will come from what is intended within the legislation, I believe, value to, particularly to the police in the Crown Office. I thank the cabinet secretary and his officials for attending the committee today at very short notice and providing that information. The clerks understand, as I have already said, that the debate on the motion is to be taken in the chamber this afternoon. Our members are content to delegate authority to me as convener to clear the draft on the report. It should be published before the motion is taken in the chamber this afternoon. That will also note any comments from the Delegated Powers and Law Reform Committee, which is meeting to consider the supplementary LCM at the same time as this committee. Are we agreed with that approach? Stuart Stevenson, yes? It is a very short time, and we have heard about that. Can I ask that you consult at least one other member of the committee, just to make sure? I do not name who. Why do not I consult the deputy convener? That is right. Thank you, convener. I am happy to do that. I now suspend briefly to allow the witnesses time to leave. 2. Is consideration of a negative instrument on damages personal injuries in Scotland order 2017, SSI 2017 oblique 96? I refer members to paper 2 and ask members if they have any comments. If members do not have any comments, then is the committee agreed that it does not wish to make any recommendation in relation to this instrument? Agenda item 3 is feedback from the Justice Sub-Committee on Policing on its meeting on 20 April. I refer members to paper 3, which is not by the clerk, and invite Mary Fee to provide the feedback. The Justice Sub-Committee on Policing met on 20 April when it took evidence from the Scottish Police Federation, Unison Scotland and the Association of Scottish Police Superintendents on financial planning and policing 2026. The Sub-Committee heard that the unions and staff associations would like to be more involved in financial planning discussions and to see the views of their members taken on board. The Sub-Committee hopes that that is the case going forward. The next meeting of the Sub-Committee is scheduled for Thursday 11 May 2017, when it will hold a round-table evidence session on local policing and the role of local police commanders. Thank you very much. Do members have any questions? Nope. No questions. We will now move into private session. The next committee meeting will be on 2 May, when we will consider public petitions and our future work programme. I spend briefly to allow members of the public gallery to depart.