Global Disease Prevention:
Infrastructure and Transformation

Marc Touitou: We had a lot of time here with you last time, and everything is good here in Geneva.

Michael Krigsman: You’re in Geneva; the last time we spoke, you were the Chief Information Officer for the city of San Francisco, so you’ve traveled quite a bit since then.

Marc Touitou: Yeah I did. Quite frankly, if you want to talk about tough choices for your career, then leaving San Francisco was one of the toughest things I’ve had to do so far, because it was heaven. I liked the job, I liked the city, I liked the people, I liked the teams, but there was something compelling in the call from the UN specialized agency, which the World Health Organization is. I’m sure we’ll get into that.

Michael Krigsman: Yes. So, tell us about the World Health Organization, and what was compelling about that phone call that took you away from being the CIO of San Francisco, to making the move to Geneva?

Marc Touitou: Sure. Well, if you remember, I got the call a little bit before mid-2014, and I was pursuing the natural goals set for the city and county of San Francisco. I was not done, we were doing well, but I was not done. But if you remember, it was 2014 and it was the year that Ebola took everybody by surprise, and so that was a main driver. And in the same way of some of the arguments that the headhunter used when he told me that I would take the job at San Francisco, because some of what had to be done had not been done before, or were considered not doable, and we had established that was not necessarily true, it’s possible. Same thing here, the world was facing a pretty serious crisis in the form of the Ebola crisis, and it was an opportunity to demonstrate that all hands on deck means the CIO and all the IT soldiers at work to help protect populations, save lives, and avoid something completely out of control.

Michael Krigsman: So tell us about the background of the World Health Organization, just so we have context, and then we’ll talk about the infrastructure, and we’ll talk about IT and the role of technology in fulfilling your mission.

Marc Touitou: Sure. You know, when you ask somebody, who do you work for, what do you do, it’s usually very easy to say. It isn’t so natural when you say, “I work for the UN.” Well, there’s the UN system. What is that? And then, so what is the mandate of the UN, and within the UN system you have a specialized agency called the WHO. So, the UN strives, I’m going to make a long story short, the UN works towards making a better world. And we’ll talk about how the UN goes about making this more achievable, chunk it into manageable chunks, and those are the Sustainable Development Goals. There are seventeen of them; and within those seventeen goals, goal three of the Sustainable Development Goals is health: ensure healthy lives and promote health and well being for all people of all ages everywhere. So the World Health Organization was created to ensure healthy lives for all populations everywhere, all ages.

So, our governance, our financing, I’ll tell you a few words about that. We have 194 member states, countries. We have our global headquarters in Geneva, Switzerland, so from my office to the left you’ve got the Jura mountain, and then on the other side you’ve got the lake and the Alps, so you’ve got good scenery. We’ve got six regional offices, and more than 150 country offices. And then I’ll tell you that the way we are financed, is that 30% is through member states with assessed contribution, 30%, and 70% is VC’s, voluntary contributions; and, I’ll take the opportunity to mention that our “Member Number One Donor” here is the Bill and Melinda Gates Foundation, and thank God for them because they are extremely active in the field of making a better world.

Michael Krigsman: That’s really interesting, so the Bill and Melinda Gates Foundation is your number one donor. Now, you’re the CIO at the World Health Organization. What does that role mean? What does it involve?

Marc Touitou: Well, that involves putting all our energy being the strategic enablers that we should be to help the WHO and its partners, and its clients - and its clients are everybody - achieve its goals. So, then we can structure how we go about that, but that’s the role. I am leading the IT platoon worldwide to make sure we do that right. And I’m sure you’ll ask me what it entails to be a strategic enabler and what kind of things do we need to transform, or support, or enable? Yeah, usual stuff: ERPs, infrastructure, but then it goes into cybersecurity with a “twist”, we’ll get into the twist [later on]. The natural business process support, except that business processes in this sector are slightly different than the one you would expect in the private sector, but your discipline still applies: information management, business intelligence, proactive BI, predictive BI, and what I call “correlation engines”. And when you get lost somewhere and you get thrown into a hurricane of unknown things, your lifeline is the stuff you’ve been trained with: the discipline of getting things done, your PMO, your management of the triple constraint, your natural ability to be a business process mapper and things like that. And they come very handy, especially under pressure of a great three [from the Sustainable Development Goals] emergency, whether it’s ebola, zika, or something else.

Michael Krigsman: So, you are providing the infrastructure for your offices around the world to conduct their daily business, but at the same time, when you have these daily outbreaks, you’re providing the infrastructure that allows them to communicate, to collaborate, to analyze the data, and perform all the other functions and so forth.

Marc Touitou: That’s the idea.

Michael Krigsman: The organization has been around since 1948, and for any organization to be in business for so long, it must go through a constant evolution change in order to stay relevant. Tell us how the WHO manages to stay relevant over all these many years?

Marc Touitou: I’m going to cheat a little bit, because somebody else summarized it better than I could. We had a visit from Angela Merkel at the World Health Assembly a couple of years ago, and she said that the WHO is the only international organization with universal political legitimacy on global health issues. And that alone explains why we don’t have much choice, we have to stay relevant because that’s our mandate to pursue those goals. We have partners, but those partners cannot get everywhere they need to be. And I think Angela Merkel is correct, and the reason she chose to say it like that is to convince our member states, all the 194 countries that constitute our governance, that we have to be given the means to achieve our goals. And we stay relevant because the alternative is unthinkable.

Michael Krigsman: The alternative being that there is no central worldwide organization to coordinate and manage the outbreak of these worldwide diseases that you look at?

Marc Touitou: Yes, I mean, if you go back to, I don’t think anybody in our organization or in any organization is going to say, “I’m always right, I’m always perfect” and so I know that if our Director General Margaret Chan had not called on the Security Council to trigger the global reaction that we got, the world would have been in a much worse shape. We can certainly be criticized for, “Hey, maybe you should have done it earlier, or stronger, or faster,” but the organization faced its challenges to help get this crisis under control.

Michael Krigsman: When you joined two years ago, I’m sure that the organization from a technology perspective, and and IT perspective, you have pushed through a lot of transformations. What have you done, and what is your agenda going forward? And I realize it’s a very broad question. What are the things that you’ve done to change the shape of how technology supports the mission of the World Health Organization?

Marc Touitou: I’m going to answer your question but first, two things. When I joined Margaret Chan gave me a few words of advice and said, “You know, we not that different from a lot of the organizations you work for and you know, people don’t like change. And doctors don’t like change either, and they know everything. So, I heard something like that with engineers in another company in another life. And she told me that I would have to have stamina, have persistence, and that change was a constant requirement, and she knew that I had to be tough. And then somebody else asked me, “What is good leadership in a political environment?” And it’s a tough question and I think for me at least, it was to know the difference between what ought to be, and what can be. Pick your battles and go back to the stuff that you know you can do.

And so back to your question, I decided to split the problem into key result areas the way I know. So, smart infrastructure, cybersecurity: cloud computing and cybersecurity, I’ll get back to that in a second; business processes, and information management. So these are the zones where I thought we need to make a structured impact. And of course in order to do that you need your architect, but you also need your army of project managers. I’ll go back to that for me, the discipline of getting things done: the PMO. Without a PMO you can’t get things done.

So my boss asked me to take the lead into what we call, our little lingo here, what you call the ERP we call the GSM, so I’m pushed to remember what GSM stands for but I don’t, but it’s our global management system. But I think GMS was taken so we call it the GSM, something like that, forget that. So we have an ERP, and we had to intensify and acceleration the calendar of deliverables for the corporate business process transformation: HR, finance, things like that. And it was given to me, and the way I was trained, usually it’s not the CIO that does that, you’ve got a business exec, and the he partners or she partners with the CIO and together they do something. But here, I was asked to be the change agent and the leader for this GSM transformation for a reason.

So it starts with having, we are a complex organization with different regions and different needs, but we have to identify the things that bring us together, so the usual corporate shared services, as I said, HR, finance, inventories, things like that because some of the challenges that you face when you have a Grade 3 emergency, certainly we say, “Boom. I need 2,000 people over there, very fast.” Say, two to three months. So your corporate processes have to allow you to find the right people, find the right skills, and the rostering of skills. Recruit, onboard, dispatch, manage, bring back, and do again. So if this sounds like it’s trivial, it’s not. Same thing with managing your supplies, your vaccines, your boots, your gallons of disinfectant. You need to start there for an emergency. So transformation was there for me, that was Year One. Then, you start into the cybersecurity, so tell me when you want me to stop, but…

Michael Krigsman: Well it’s pretty interesting, and right behind you, there is a photograph of, it looks like the WHO digital platform. And maybe you can explain what that is.

Marc Touitou: Yes, in fact, when you do your due diligence, and you say, “Ok, I’m beginning to understand the problem that we all face,” you’re no longer the IT guy, you’re not the IT guy. So, forget the acronyms you [use], you can think you’re the Chief Process Officer, forget that. You’re an executive in an environment, it just happens that you know your IT weapons pretty well, and how do you bring them to play, and help everyone? So in the process of identifying my partners, my boss told me, “So you can talk to, you’ve got Red Cross, you’ve got Unicef, you’ve got all these different agencies that are natural partners, the World Food Programme.” And then of course there’s the CDC. But when we say the CDC we think of Atlanta, but then of course there’s the European CDC, the Chinese CDC, [and so on]. And so I thought, “Why don’t I go visit my brothers in the US at the CDC? I want to know what they have, what they do, what they share, and what do we have in common? So I went there and so there was good news, more good news, and then a plan, which you saw behind me, which is a visualization of our command center. So I went there, and I saw a plateau of watching the hurricanes forming, watching a cholera outbreak, watching the Ebola in West Africa, watching… You know, they are divided by SWAT teams per topic. And I thought that was very refreshing and reassuring that some of that was already in place. And it hit me that this was good, but it may not be good enough, and they don’t think they’re good enough either, they know better, so I came back.

And then, my director general Margaret Chan said, “Ok. What did you see? What have you learned?” And then I started to tell her and she said, “Shoot me a video of what the future should look like.” And I thought, “Wow. Ok.” This is the first time my CEO said it like that, and she said, “Marc, you need to synthesize it in three or four minute video that shows what we can do. Not Vaporware, not science fiction stuff, show me what we can do.” And I was like, “Ok!” So I went back to my awesome team and they said, “Yup, Ok, let’s get cranking,” and we shot that video of the shared command center of tomorrow,” and tomorrow doesn’t need to be in three years or in a galactic enterprise, it’s something we know we can put together and share with all our partners, inside WHO and outside WHO.

Michael Krigsman: And so, in that command center, what are the components of the command center that you would use to manage a major global health crisis?

Marc Touitou: So if you look through this side here, you can see, well you have maps to my right, you have supplies… So the idea is, whether it’s tactile or not is to say, “Well, I want to see all my warehouses worldwide. I want to see how many of that item I have left there, and please superimpose all the water points here, and tell me how many medical centers I have in a radius of 25 miles, or tell me, you know, what helmets are here. You know, you have the streams from the media center, and you have the maps that you can superimpose, you’ve got all the infrastructure information that you need at your fingertips in near real time.

Michael Krigsman: I was going to say, where does this data come from? I mean it’s extraordinary you’re collecting data from around the world, so where is that data come from?

Marc Touitou: So, your natural partners, if the World Food Programme is in charge of making sure that supplies, whether it’s milk or beans or whatever supplies they need to deliver in particularly tough places around the world, the mature command center of the 21st century that we need, every relevant player feeds into your visual command center. And by the way, don’t think for a second it’s finished, it’s done, or whatever. No. You’ve got feeds from social media that we can use, you’ve the meteo-center, we want to know if there’s going to be a very bad weather condition in a zone where we need to intervene, and if it has a correlation on the spread of a particular virus or you know? Things like that. So, this, I would argue and I know it’s going to be a controversial statement, but I don’t think anyone has such a complete command center today. And it has to be a command center and it has to be a shared command center within regions, but also for the partners and member states that need to access it.

Different roles and responsibilities during ebola for example, you had particular people with different roles, some about the vaccine, some about contact tracing: we need to know when did that person get infected, who did that person talk to, or touch, or possibly contaminate; that’s called contact tracing; and you need to report back, even the variables of people, we needed to have better information on this. And I think we all know and we all acknowledge, because we are all reasonable people, that during ebola, same thing as when we do disaster recovery in IT, right? Then we do a post-mortem and then we say, “What didn’t work? What must we improve in our process?” And so what we saw on the command center is we know we need this, we need better GIS, geospatial information systems, we need better business intelligence, better reports, faster reports, more accurate reports. We don’t want to discover something happened three weeks in the past, we want to know it happened two hours ago, and when people ask “Why two hours?” I say, “Well, two hours is pretty damn good!”

Michael Krigsman: So we have a couple questions from Twitter, and the first one, Arsalan Khan is saying that the US has developed, or is creating a federal healthcare architecture, and is there something similar or even bigger, some analogue, that the World Health Organization is working on?

Marc Touitou: Well, Ok, I’m not the authority in that zone, but I’ll tell you that the international framework exists. You’ve got I-CHAR and a few other frameworks in which WHO is extremely active, leading some, building on some others, and we don’t re-invent the wheel. So, these are mature, frameworks at play, so I don’t think you’re going to find out that there are things that don’t talk to one another, between, you know, United States or even one state in the United States, and then Europe. We’re not completely there all the time, but these are things that are very international.

Michael Krigsman: And along those lines, Chris Petersen asks from Twitter, as an international organization, do you have to deal with hundreds of countries’ different, unique data rules?

Marc Touitou: Different data rules?

Michael Krigsman: I think what he’s talking about is, as you are collecting these data feeds, and many of these feeds originate in these remote locations, what are the constraints that you have to be thinking about as you’re collecting this massive amount of data?

Marc Touitou: Well, first of all, it’s a moving target, but, we have a WHO country office in over 150 places, 150 countries, so when we ask for what we call a “sit-rep”, a situation report, it is a standard thing. And maybe it is not as standard thing as you would want as an IT professional when you exchange electronic files, and in fact, depending on where it is, the way it reaches you is not the same, but the struggle for us is less in the standard formatting of the information, and more in the means and speed or the means required infrastructure-wise, which is also in the frame of IHR, to make sure if you’re in a place where you’re not as lucky as we are, where you’ve got WiFi and high speed bandwidth...  remember when the information comes, it comes from the field - goes from place to village, from village to district, from district to country, from country to region; so the way you get back all your information into what you hope to be a single point truth, that’s the thing we have to improve on more than agreeing on the vital information or the minimum information that must be transmitted from A to B.

Michael Krigsman: And so, what is your plan and what are things you’re doing to collect this data rapidly and overcome these challenges that you’re just describing?

Marc Touitou: Well, first of all, as part of the transformation, remember if you ask me, “Ok, the vision for IT, the mission for IT, the strategy, the battles we choose to fight, and the strategy, the tactics we commit to the battles,” I will tell you that to be strategic enablers, we need to be with the business. The reform of WHO includes… Before ebola we had two business units (sorry to call them that), one for humanitarian and the other one for pandemic, and we realized that in fact there was an executive decision strong of what we had learned, and we believed that we would be stronger to merge the WHO health emergencies, so we now have this merged business unit called WHE, adn we have a new executive that joined us this summer, and we are going to continue our action to support the emergency business unit on...  Ok, they prioritized the key processes they want to see improved, you can that they are extremely interested in enabling as good of a command center as we can have, as fast as possible. They are very pragmatic people, so it’s not a beauty contest or about having the most elegant LED screen, it’s about being able to do the work that they are able to do, better faster. So that is what we are working on, for the emergencies. But WHO is bigger than just emergencies, so we have other goals in the Sustainable Development Goals. So, let’s not forget that other business execs in our enterprise, they are called “ADG’s”, Assistant Director Generals, so you’ve got Emergency, we talked about it, but we have the other business units on communicable disease, noncommunicable disease, family, women, children, and others. So we need to understand our goals and find a way to help them achieve their goals.

As part of that transformation, in the category, remember I talked about the four buckets, HR, cybersecurity, business process support, there’s the IM, information management reform, understanding what information assets we have in the World Health Organization, including one that I like called the Global Health Observatory, where we get information from countries on all dimensions of health. That’s a good base, but we want to go beyond collecting what happened last year, and we want to know what is happening now? What is happening tomorrow? That’s the next frontier.

Michael Krigsman: What about cybersecurity? I know that is an extremely important topic for you, as it is for many different organizations, but you are so over-distributed, in over 150 countries. How do you deal with that? It’s got to be overwhelming.

Marc Touitou: It can be. It depends what you’re trying to resolve or to protect against. Privacy is important to us, security of course. I can tell you that two years ago, when I started to talk about cloud computing, I saw some smiles, some funny smiles, like, “Oh, I hear you think we’re going to do cloud computing!” And I could not understand why the skepticism or the irony, and I realized pretty quickly that talking to some of my internal partners, who by the way, at the time, were not necessarily natural partners, they were like, “No. We’re not going to do cloud computing, it’s not possible.” “Well, what do you mean? Cloud computing is not something to save money, something to enable speed, we’re going to cut ourselves off from a lot of opportunities if we do that. Rather than telling me it’s not possible, why don’t you explain to me the things that we must overcome for you to find cloud computing acceptable, because you shouldn’t care how/where I do it, but you do. So, what’s the problem?”

So I was explaining it to them, and I said, “Look, when you were in San Francisco, you were US gov., so you had to make sure it was government-class cloud.” And we were probably one of the first cities in the US to have a government-class cloud with everybody in there. Great! Well, here, it’s not French gov. or US gov. or whatever gov., it’s an international enterprise, and we have diplomatic immunities that must be preserved and protected. Ok? Alright. So I said, “If we go to the cloud, we will be encrypted, yes? But you will be encrypted, but you don’t own the keys, the keys are owned by the cloud owner, whether it’s Google, Microsoft, whatever cloud you choose. And that means that if they are under subpoena to provide data, they have to execute themselves. I said, you know, it wasn’t appealed by Microsoft, or Ireland, or another one, you know, Google, so I said, “Wait. What if I enable encryption with me, WHO, owning the keys. Would that be ok?” And they said, “Yeah, can you do that?” I said, “Yes, we can do that.”

By the way, we’ve done that, and we are the first UN agency to have gone in the cloud, fully encrypted, hosted in the cloud by the cloud vendor, which is great, and on top of that, encrypted by us with proprietary keys. So, problem resolved, and the internal people that were charged with protecting this are now natural business partners, and I’m saying, well, those guys are really enablers and now we’re in the cloud. We’re in the cloud on ServiceNow, we’re on the cloud on our human resource platform for rostering, onboarding, and recruiting (and also I’m forgetting a couple) but okay, it’s done. And Office 365, in the cloud also encrypted. So it’s creating some vocations in other agencies, in other locations. So it’s good!

And it’s one challenge. If anything, you know, the breach, the hacking, whether we’ve seen it in Yahoo or even in US gov., this has been the decade of hackers and wake up calls for CSO’s and CIO’s all over the world. It’s a sever concern for all of us, and it’s not going to disappear anytime soon. We have to make sure that we have information classification done well, we have to identify the assets that’s public, what’s restricted internal, what’s trade secrets, what’s diplomatically protected, things like that. But, we haven’t found a problem that we could not resolve for now.

Michael Krigsman: So, you have not been hit, hopefully not yet, with a major data breach. So so far, what you’ve done has worked.

Marc Touitou: [Laughter] Maybe. No I think that more than this, maybe what’s important is, it was more enabling us to go to the cloud, with all reasonable measures of protection. Look, I’m not naive. If it was possible to hack into a federal database and steal my biometrics, somewhere in Washington DC, then I have no reason to believe it won’t be possible anywhere else. I don’t have the arrogance to believe that we’re bulletproof, but I was just using that example to say that when you’re discussing with your business partners internally, there are solutions in innovation, in this case there’s a new software platform to keep our keys and to encrypt; which by the way is not trivial. You need to understand what you’re doing. There are some tricks in encryption.

 Michael Krigsman: But I will say that it amazes me when CIOs of even smaller organizations say, “Oh, we don’t trust the cloud because we can do a better job with security, a better job than even the major vendors,” and it just seems impossible to me, for an organization of almost any size except maybe the very largest organizations in the world, the cloud vendors are going to do a better job with security.

Marc Touitou: No, I believe that. I think you’re right. I think that it’s a condition of business. The cloud providers are very well-equipped and I think they are in a better position to provide security, and yet, they will be hacked in some ways.

Michael Krigsman: So we have just a couple of minutes left, and so very quickly, what is on your radar for the next big thing that you are not focused on? And very quickly, because we only have a few minutes left.

Marc Touitou: Well for me, there’s no doubt that infrastructure, whether it’s new ground, your network, your servers, whether you do insourcing, outsourcing, cloud, no cloud, doesn’t matter Infrastructure is supposed to be under control. Your business processes, you need to be smart, your businesspeople need to be smart, you need to be good in Lean Six-Sigma and improving your business processes, been there, done that, okay. Ok, cybersecurity is a curveball thrown at you, so if you don’t have a CSO, get one, get a team, get some means, and get cranking.

So, what’s next? You’ve got smart infrastructure, you’ve got smart processes. So for me, the next big thing has to be in the category of information management. So you see, I can tell you, dear CEO, dear board, that we’ve sold so much of this, our profit margin was that, blah blah blah. Boring! So in our business, I want to be able to say one day, “You know, from what we’ve been able to analyze from our correlation engine,” this one’s a good one because that’s innovation, “we have a .87 probability that there’s going to be the next pandemic here, on the map.” Wow, okay. So, between predictive analysis, so the advanced BI, and the correlation analysis, that’s where I’d put my money. Well, figure of speech. And we are currently in discussions with some people that believe that this is true and believe that this is closer than we think. So I said, “Fine, well, I’m going to throw a couple nasty ones at you, and show me what your correlation engine can do.” I can tell you that there’s a lady who used that model, and she predicted the cholera outbreak in Cuba two months before it happened. Now, using the same technique, people we talked to were able to validate a model that took a medical research team about two years to conclude. Their engine validated it within weeks. Now that gets me excited.

Why? I don’t know how many minutes we have, but in an interview last year, Mr. Gates was asked, [they] wanted to know what scares him, what is the thing he’s afraid of. And he said, this was a great interview with Ezra Klein, he talked about the most predictable disaster in the history of the human race. So, it’s not an if, we know it’s going to happen, but when we look at the “death chart”, and yes there is such a thing, then you see, so I don’t know, Michael, what do you think is going to kill in excess of ten million people within a year? Is it going to be aliens? Quakes? Volcano?

Michael Krigsman: Well, let’s see. I really have no idea. What could kill ten million people in a year? I guess we’d have to look back. Aliens is a good answer, I suppose, but if we look back in the history of the US, we’d probably be looking at some type of infectious disease, assuming it’s not an intentional act of war.

Marc Touitou: Well you know, Mr. Gates was a bit optimistic and you know, but it was an educated answer. If you look at history, what did kill millions of people? So if you look at the chart, you’ll find, you know, as Mr. Gates pointed out, the blip in WWI, with 25 million people, and WWII, 65 million people. And in between, you had another one, one with whom you cannot negotiate much: it’s the Spanish Flu virus, which killed about plus or minus 50 million people, and that’s the beauty of it; people cannot give you an exact number. I think the latest estimates were about 65-100 million people.

Michael Krigsman: So, some evolution of the flu virus. That’s a very upbeat way to end this show, and I hope that you at the World Health Organization are going to make sure that it doesn’t happen.

Marc Touitou: Well, yes. That’s the idea. That’s what everybody works to prevent, or at least ot be better prepared. I like to say when I see turf wars or silo thinking, I usually tell people, “Remember to not forget why we work together, or what it takes to prevent the next pandemic. We work together because should a Spanish Flu virus be unleashed on the modern world, remember, the last Spanish Flu was 1918, but if you saw something like that as nasty a strain on the modern world, the mathematical model funded by Mr. Gates shows that we would see in the range of 33 million people dying within 250 days. If this doesn’t get your attention, if this doesn’t warn you, doesn’t make you want to forget your badge, forget your brand and say, “I’m in,” then I’m not sure what will. Because that’s the real, “No flags. No boundaries. No political blah blah blah.” This is humanity and this is the threat for our global population. I think that’s the real inspiring reason that we should all work together, to be better prepared.

Michael Krigsman: Well, thank you Marc Touitou, Chief Information Officer for the World Health Organization, for spending the time with us today, and for really presenting maybe the most compelling case there is for putting aside petty differences, and remembering the mission of the organization we’re working with, and focusing on the goal as opposed to all of these little differences that we might have. Marc Touitou, thank you so much.

Marc Touitou: Thank you.

Michael Krigsman: WE have been talking with Marc Touitou, the CIO of the World Health Organization on Episode 197 of CXOTalk. Thanks everybody for watching, and we look forward to seeing you soon. Bye, bye.