Schneier on Security

Denton Scratch • April 27, 2018 11:42 AM

I worked as a software contractor for the TSB before they merged with Lloyds. Actually I was under the direction of a consultancy company that was working for the TSB. It was a major project – we were building a completely new front-office system.

There were hardly any TSB permies on the team, and those that there were were deadbeats. Some of the best-paid techs in the company were a handful of COBOL programmers (contractors) who had knowledge of the legacy systems. I presumed that meant that none of the permies knew as much as these contractors.

I stopped shortly after the Lloyds merger was announced (for other reasons). As far as I am aware, merging the TSB and Lloyds IT operations took at least another ten years, and cost $LOTSOFMONEY.

@JustAGuy “This smells like a failure of architecture/design & having the wrong developer expertise.”

This is not a mistake perpetrated by some employee or consultant; rather, it is a very serious management failure. If there was a mistake made by some staff member, then it is unquestionably management’s fault that this was possible. Umm, which management? Not Lloyds – they’ve sold the business. There can be no question that the fault lies with Sabadell management.

I used to bank with the Abbey National, a former mutual society that was privatized and promptly acquired by a spanish bank (Santander). The result was a sharp decline in customer service, and a sharp increase in prices (who would have thought it!) The TSB was never mutual, although if you squinted it looked a bit like one. Nevertheless, I wouldn’t have wanted an account with a spanish-owned version of the TSB, based on my experience with Santander.

Incidentally, this is all delayed fallout from the 2008 banking crash: Lloyds had to divest themselves of some of their operations for monopoly reasons, following their acquisition of HBOS (a ‘rescue’), which gave then an absolute majority of high-street banking outlets. The HBOS acquisition was a huge mistake for Lloyds; I am sure they were forced into it by the UK government (which subsequently acquired a 43% stake in the company in exchange for bailing them out). Without the HBOS acquisition, Lloyds would have survived as the only UK high-street bank still standing on their own feet. I was an HBOS shareholder AND a Lloyds shareholder, and lost a lot of money in 2008. The operations that they decided to sell to Sabadell were the TSB branches.

I’m sorry for the TSB customers; they didn’t have much opportunity to switch elsewhere, because nearly all the high-street banks failed in 2008. (The Coop didn’t; that failed in 2013, as a result of desperately incompetent management). There is currently no example in the UK of a high-street bank with management that inspires confidence.

Denton Scratch • April 28, 2018 4:32 AM

@RealFakeNews

‘Just look at some of the posts here in this thread: “it was a management problem”.’

Well, unless the company is a one-man show, it’s always a management problem. If the staff are incompetent, management’s job is to know about that and fix it. If there aren’t enough staff, that’s a management problem. Management is there to make sure the business operates smoothly. In particular, migrating from an old and hairy legacy system to a shiny, new Javascript/EJB buzzword-based system is almost by definition a management problem.

Of course there must have been a failure of QA; of course they should have had a way of rolling back the change. No doubt there were greybeard techs telling management that without QA and rollback, they shouldn’t throw the switch. The greybeards were presumably overruled by management, who were looking nervously at the bill that Lloyds were presenting for another year’s rental of the Lloyds core banking system (I can’t find the number right now, but I think Lloyds were charging Sabadell like £70 million a year).

Techies are not hired to manage banks.

I’m not sure what your point was about AngularJS, but I think it is an appalling idea. If they are using AngularJS in their frontend, then it would be no use to me anyway. I distrust scripts. But most of that buzzword bingo stuff is to do with the frontend; it wouldn’t be such a big deal if this was just a broken user-interface. But what Sabadell have tried to do is to migrate the TSB accounts to a brand-new backend, based on their own in-house backend. My guess is that this modified Sabadell backend is what has caused all these problems.

By the way, does anyone else share my distaste at the idea of having their banking transactions processed in AWS?