Scaling public services under pressure: lessons from this spring

In the past eight weeks, European administrations have shipped digital services at a pace nobody would have called possible in February. Short-time work schemes went online in days. Benefit applications that required a counter visit became forms. Agencies that exchanged files monthly began exchanging them hourly, because citizens could not wait for the batch.

Working alongside several of these teams this spring, we have seen both the best improvisation of our careers and the seeds of future incidents, often in the same week. Both deserve honest accounting.

Worth keeping

The speed came from permission, not technology. Decisions that normally took committees took a phone call. Existing APIs were reused instead of rebuilt. Perfect was, for once, not the enemy of deployed. Teams discovered that a service could go live with a narrow scope and grow, which is how software has wanted to be delivered all along.

This is the part that deserves to be studied rather than forgotten once the emergency fades. The bottleneck in public-sector delivery was rarely the engineering; it was the layers of process that surrounded it, and the crisis proved that much of that process was optional. The challenge for the autumn is to hold onto the permission without also keeping the corner-cutting that came with it, to separate the speed that was real capability from the speed that was borrowed against future risk.

Not worth keeping

• Credentials shared by email to get a partner connected by Friday, still valid today, remembered by nobody.
• Point-to-point links wired directly between systems because the gateway review queue was too slow in March.
• Personal data flowing under emergency legal bases that will not survive the emergency, with no record of exactly what flowed where.

Emergency shortcuts are honorable. Emergency shortcuts that outlive the emergency are simply the new attack surface.

The danger with each of these is not that it was wrong in March, when the alternative was a service that did not exist. The danger is that crisis infrastructure has a way of becoming permanent by default. The shared credential nobody revokes, the direct link nobody governs, the data flow nobody documented, each was a reasonable trade under pressure and becomes an unexamined liability the moment the pressure lifts and attention moves on.

The autumn's work

The task now is to keep the speed and retire the debt: inventory what was built, bring the improvised connections onto governed paths, rotate every credential issued in a hurry, and write down what data went where while people still remember. The administrations that do this will exit the crisis with something valuable, proof that they can move fast, and infrastructure that no longer requires bravery to operate.