---
tags: dsh
---

# Data Safe Haven Meeting 01-01-2023

::: spoiler TOC
[TOC]
:::

## Schedule

| Time | Item |
|-------------|----------|
| 0 - 5 mins | Project update |
| 5 - 50 mins | Agenda items |
| 50 - 60 | Actions and delegation |

## Useful links
- [Note of notes](https://hackmd.io/lqDJIxN0SfS7OkBXX7xlLA)

## Attendees
### In attendance
- James Robinson
- Martin O'Reilly
- Arielle Bennett
- David Sarmiento Perez (@all you dont need to use my second surname 90% of the time, just official stuff)
- Kirstie Whitaker
- James Hetherington
- Jules Manser
- Ed Chalstrey

### Apologies
- Hari Sood

## Project updates
- DARE bid submitted
- December DSG
- RSE TRE WG meeting

## Agenda
- [name=James] Last month's action points
- [name=James/others] DARE UK funding proposal
- [name=David] University of Nottingham deployment
- [name=James] Strategy for upcoming year
- [name=Jules] DSGs 2023 - first one in Feb! (then March (no deployment needed), May, September, December)
- Project updates

### Last months action points
- [name=James] To have a conversation with Martin/REG to figure out how to allocate appropriate funds to service area. Can this come from OOB funding?
- [name=Martin] Yes. Will the EL and OOB parts of the funding have the same or different finance codes?
- [name=Arielle] I would prefer they were separate finance codes to distinguish BAU and development projects
- [name=JamesR] We also need to discuss cost recovery
- [name=Martin] One of the goals of the DSH project is to develop sustainable funding models for both development and running a DSH at the Turing so the project can underwrite the DSH costs if needed.
- What does it cost to run a Turing Safe Haven? How do we pay for it?
- [name=JamesH] Look at UKRI TRAC Facility Model, which allows infrastructure and people costs to be recovered by a "service charge". UCL are looking to do this for data storage. There are others also using this model.
- Believe in a model that is free for sole researchers/those unable to pay for it, but that makes sure research teams include its costs into bids and grants.
- [name=David] Talk to Dundee/UCL about collaborative agreements
- [name=Hari/David] Planning the AI UK stand
- [name=Hari] Check in with Lily about AI UK programme (e.g. mainstage/roundtables etc.). Can't pitch before Xmas but if we can get back to her in Jan we can chat then
- [name=Hari/David] Plan team strategy session for first week of Feb

### DARE UK bid
- Call [here](https://dareuk.org.uk/our-work/phase-1-driver-projects/)
- Our proposal for the Reference Architecture strand is [here](https://thealanturininstitute.sharepoint.com/:f:/r/sites/SafeHaven/Shared%20Documents/External%20Funding%20Applications/2.0%20Applications%20-%20Other%20org%20as%20lead/DARE%20Phase%201b?csf=1&web=1&e=rWPZKZ)
- Submitted 14th December
- Interview 19th January
- Call page doesn't have a decision date, but says *"projects to start no later than Monday 23 January 2023"*

### University of Nottingham deployment
- We found out that University of Nottingham are using the DSH for their TRE
- Hari/David spoke to them [see here](https://hackmd.io/CpPq9p98Rv6VSKNOC80RpQ)
- Would be good to exchange penetration test results with Nottingham (they have run one of their own against v3.x)
- How can we best advertise security issues? In public?
- Nottingham seem to consider updating their deployment as a relatively big deal, requiring an associated ~£10k penetration test. How can we make keeping a DSH instance updated easier / cheaper?

### DSG debrief
- DSG December 2022
- Four projects ranging from tier 0 to tier 2
- Tier 0/1 challenges dropped Safe Havens part-way through
- Several setup/support issues [see here](https://thealanturininstitute.sharepoint.com/sites/SafeHaven/Shared%20Documents/Forms/AllItems.aspx?FolderCTID=0x012000CD084B0C0D5E2A4E95F3C0F9BB47E2CB&id=%2Fsites%2FSafeHaven%2FShared%20Documents%2FMeetings%2F2022%2D12%2D19%5Fdsg%5Fdebrief%2Emd&parent=%2Fsites%2FSafeHaven%2FShared%20Documents%2FMeetings) for details
- [name=Ed] Can we avoid December/August for DSGs or is that out of our hands?
- [name=Jules] -We dont have DSG in Aug, but do early Sept. Dec is looking like it will be an online event, which I try and push for tier 0, 1 only, so perhaps no safe haven?
- What does shared remote environment get you?
- Reproducible
- Scalable
- Collaboration
- Supported
- Many (most) things should work out-of-the-box
- Better intro/tutorial work to set expectations
- [name=Martin] we might be making trouble for ourselves by bringing tier 0&1 into DSH
- [name=JamesH] It is not only the data that needs to be tier 0/1 but also what is made with it
- [name=JamesR] Most complaints from users seem to be around having to go through extra steps and complications to work with the data, specially when that data is publicily available
- [name=David] This is a recurring issue, voiced by other in RSE community as something their users express

### Strategy for upcoming year

- Write project statement about what we're trying to do

#### Infrastructure/processes
- [name=Martin] Working on a shared model + system for reproducible TREs, where a core set of organisations are collaborating on common processes and code.
- [name=JamesR] Working with others to build one (or more) open-source, reproducible TRE codebases that can be easily deployed and, when combined with a sensible data handling policy, give you an overall TRE whose security you can have confidence in.
- [name=Jim] Further to the above, work with others on more general tools which can be useful across TRE implementations (_e.g._ sensible default VM image, data classification tools, IG process tools).
- [name=Martin] Ensure we're working with both DARE and NHS initiatives.
- [name=Arielle] Plan for sustainability incl additional funding sources and projects we would like to initiate (alongside existing grants and plans)

#### Running in production
- [name=David] Figuring out the Service Model that any TRE involves, whether or not Turing offers it, consider how running a TRE affects organisations. Likewise running user research to stablish what level of user education is needed (make it clear why a TRE is the thing to do, despite incovencience). Leaning on the RSE TRE community
- [name=Ed] Expand the TRE service area in REG to include more than just me and Callum, so people being on leave becomes irrelevant. Assign specific people to DSG support for a given DSG, with the rest of the service area being overflow support
- [name=Jules] Better user tutorials for getting to know the TRE quicker - Moodle power
- [name=Ed] Do we need a training course for this? Or videos?

#### Talking about what we've done
- [name=Arielle] Write up of work that was completed in 2022/early 2023 (e.g. data governance work, user testing, working group blog)
- [name=JamesR] Also publishing the various papers:
- [Design / policy paper](https://www.overleaf.com/project/5be44b3c6ae92f7a2e217ef7)
- [DSH technical description paper](https://www.overleaf.com/project/60cb1a9978f238d3149b6936)
- [TRE comparison paper](https://www.overleaf.com/project/637243f6c5e0ab8111680d12)

#### Thought leadership
- [name=JamesH] Do Turing want to be maintaining their own TRE?
- [name=JamesR] Can't change the choice of TRE that others are using but we can work on making the most widely used TRE as good as possible
- [name=Kirstie] We're still leaders in the space both in thought-leadership and actually running this in production. Could have a partner offer DSH as a service (e.g. 2i2c)
- [name=Martin] I also think we are still at the cutting edge of thinking about and solving the problems in this space. I also think we do learn something / maintain our expertise / credibility by both running and developing a DSH. I agree other organisations are choosing Microsoft AzureTRE over ours and we should be honest with ourselves about how much of the impact we want to achieve depends on our implementation getting more widely adopted. Microsoft (and AWS) haven't committed to maintaining a community product.
- [name=Arielle] Need to know Microsoft's interest in keeping their TRE open
- [name=JamesR] Is there any way we can compete with Microsoft offering TRE setup and deployment as a paid service?
- [name=Kirstie] Possibly via 2i2c?

### Project updates
- DSG Review (increase resource in service area?)
- AI UK
- David to take over these meetings?
- Comms plan
- Strategy work (w/ Simon Reeve?)
- 2023 project landscape

### Sustainable Turing TRE deployment

### Actions
Not discussed during the meeting but clearly:
- Organise Strategy meeting David/Hari
- Put DARE UK agreement in place with Dundee
- Organise AIUK Demo
- Discuss and propose roundtable/workshop
- Meeting on cost recovery / fund allocation for service area