S02-E02-Research-IT

Welcome to Bites of Experience, where two retired Canadian higher ed CIOs share unfiltered insights on campus tech, strategy and leadership, serious experience with a lighter touch. Welcome back to Bites of Experience, I'm Bo Wanchiner, joined as always by Dana Sanderson. Today, we're talking with Jill Kowalczek from University of Calgary about leading research IT where national infrastructure, campus operations and security intersect. Jill's career spans Westgrid, Capoeu, Canada, Kansok and leadership roles within national organizations. She's also served as the chair of Sierra's Board of Directors. Now two years into a role that sits between IT and research at UCalgary, she's uniquely placed to talk to us a bit why this role and what works and what doesn't and how to build trust across the campus. Jill, so great to have you join us today. Tell us how that path shaped your view of the research ecosystem. Oh yeah, absolutely. So I've always been drawn to the same types of roles and challenges, that is the intersection of technology and people. I'm a big believer in technology in terms of what it can enable and what it can support. I love helping people, solving challenging problems and finding different ways to deliver value to Canadians in general, whether that be in research or in the infrastructure that supports research or in the case of Sierra, how it can help all Canadians. I think the biggest thing I've learned across all of these different roles is that there is significant value in working together, working together across different things to solve challenging problems. That being said, one thing that I will say I knew before but really gets driven home and my new role at the University of Calgary is there's no one silver bullet to solve all problems and most things need to get looked at with a unique lens to the current challenge or problem. I think it's great that you started right away with technology and people and this is something Dana and I have run across in a lot of our sessions, you know, a lot of times it boils down to people and I think we've got a couple coming up this season that might try to counter that and I think it's going to be an interesting discussion. So let's focus a little bit more about the role you have at University of Calgary that's sort of embedded between IT and research. So why embed that role in IT rather than in the VPR's office or maybe research services or maybe that's the same thing at your institution? Oh yeah, so ultimately when I answered this question about my role at the University of Calgary and I would say I've answered different questions about organizations or organizational structure and why one organizational structure will work or won't work. I will give the same answer to every question which is anything can ultimately work and it really comes down to the people and the people that are in place there. What I've learned at the University of Calgary in this space and in looking both here and as well as what I see across other institutions is that silos are broken down as much as possible. There has to be strong integration and alignment between groups. So in this case from IT and research services and the VPR's office, we work really hard to build relationships between those three different groups to most effectively support our research community. My role is embedded inside IT if you were to ask me to pick one I would say I would lean more so on being embedded inside the IT space at the institution because you can leverage expertise in enterprise IT services and support where it makes sense. If you're looking to scale out your operations both in terms of what you can support as well as you can operate on a bigger scale, being embedded inside IT can provide this opportunity. It also allows you to influence technology decisions to support the research enterprise. I do this quite a bit and have a great team that I work with inside the IT environment that will listen to my input and feedback about how we can change or adjust different initiatives to support that. I think a big good example that currently exists is we're undergoing a major network refresh and we're sitting in there influencing how we are deploying that refresh across campus to see what we are seeing coming down the pipe related to research. Big data projects, different instruments that are coming on campus, how can we most effectively move that data across our campus as well as out to the research and education network and where appropriate the commercial internet as well. The last thing I'll say is both of you know I spent quite a bit of time working within Kuchio and working directly with CIOs and I will say there is a heavy driver on leadership and leadership development, building teams, building culture and using that to deliver services in an efficient and effective way and I think there is significant benefit to this on the research side of the house particularly as we look to scale up. Yeah, I really like that notion that you get to sit at this table to help inform that discussion because it's always been interesting over the years talking to the researchers and what their expectations are of the campus network in terms of what it can't do and then you know what it really can do and you know in most schools it's quite a robust network but there's some new things that are happening where even though we've got very very low latencies we still got to move massive amounts of data very very quickly from one side of campus to the other side of campus and they're depending on how you've configured that network it can have bottlenecks. So I think it's great that you guys are having that discussion and I would expect no less from a university like Calgary. Yeah, that's an interesting perspective having that being one of my last projects. Even UPI was you know we all this wonderful new technology all this Cisco networking and I said yeah, but we do know we have to fix the wires that are in these buildings that are decades and decades old I'm sorry data still moves on wires. Even when it's wireless they're still still ultimately moves on wires. So your two years plus in the role has your sense of what the job should deliver has it really changed and what surprised you about faculty or the VPR's expectations and do other schools have roles like this? Yeah, so I wouldn't say anything has changed per se. I will say that the biggest surprise for me was that working at the university is the hardest job that I have ever had and I have had some challenging jobs as you all know, but certainly this is the hardest one. I was actually at a data summit last week where I was sitting at a table and I made this comment and there were people at the table who used to be at universities and now we're at organizations that support an institution and I would say they 100% agreed with me. I think the biggest thing is the amount of work and things we need to support is insurmountable like the resource thing that we ultimately have. It is challenging to say no and we could talk about whether or not the IT or the CIO has the ability to say no, but even inside that context we don't want to or we can't, these are all things we need to do and we need to enable. So finding ways to do that inside an institution is really, really challenging. I wasn't surprised about faculty or VPR expectations. I would actually say in thinking about the answer to this question, most, most, not all. Some expectations are completely unrealistic, but in many cases, what researchers needed or required in their expectations for it was not unreasonable. We didn't have the resources to complete them in what would be a reasonable amount of time. Many times for some of the requests that our institutions are really long just because we don't yet have the people to ultimately support it. What I think will become interesting in this is how AI changes that and how much we can automate and leverage some of these things to make those things easier to free up time for the harder things. That's a big driver at our institution right now and it will be interesting to see how it, the challenge there is that oftentimes to save time and money, you need money, and so that's a constant balance that we're working towards, at least at our institution. So you know, if you've been listening to this podcast, you would have heard me talk about how important the relationship is between the CIO, the VPR and the chief library. And so does being inside IT give you more credibility with faculty, researchers, and the VPR or does it create friction? And how do you balance operational authority with research, authority, autonomy, sorry? So the answer is both. IT, like many central services inside an institution are hampered with that challenging job and a reputation. We need to deliver so much. We have so few resources, there's a lot of bureaucracy. And so working with IT can be slow, as I mentioned before, and it can be expensive, expensive. So to offset this, you need a CIO and an IT team that really understands the value of research, what it can do, what it takes, and what it can enable. And you have to have the ability to prioritize some key research initiatives to help build that credibility. And so you can't do absolutely everything for absolutely everyone all of the time. So you need to pick some key things that will help you build that credibility and support, and then move forward and leveraging and building off of that. So the balance side of the question you ask takes time. Ultimately, we're all about finding different pathways to make things happen. We work with research teams to help them understand the risks and challenges. And we also let them do the things that they need to do, which aren't too risky. If you're looking to do something that isn't using sensitive data, we try to find the quickest and painless path to your solution and what you need. On the flip side, if you have very sensitive health or personal information, there are hoops to jump through, and we look to describe what those hoops are, explain why you need to do this, and build that forward. And in the general cases, I will say, our research community has been quite receptive. Strong relationships with other key institutional partners, such as supply chain, legal privacy in the research services office are key. If we're all moving in that same direction and supporting each other and passing groups in between, that it makes things a lot easier for all of us. You know, that's an interesting perspective you talked to here about the sensitivity, the data that the researchers are working on. And you know, one of that, you know, and Bo knows me, and you know me, and a lot of people know me. I like things that are simple and easy to understand. And you know, I was always a big fan of analogy. So just stay between the ditches. The only thing with sensitive data is you just need to understand the road gets much, much narrower, and the ditches become that much deeper. So that's a great analogy. That said, so often dealing with the ditches will call it is how do you make the case, though, for reoccurring funding for the research platform for the stakeholders? Because I mean, you mentioned it, right? You talked about you need money for people and you need money for tools. And so, you know, what's the case? Have you had to actually make that case? Yeah, so I will quote something that our VPR said in a meeting recently, which is research is expensive. There is no way about that. If you track the course of the University of Calgary on our research portfolio, we have been on a steady increase in research dollars and our ability to attract that. And I will say that has been done with a significant investment and dedication into that. That being said, if you can provide services and things centrally, you can make things more effective and efficient. So we've made a case locally that allows us to better leverage national resources. We have essentially funded team out of base operation. And then we can use that to fund other things. So we support researchers and getting other funding by providing that and getting some dollars back to support augmenting and building out the initiatives in that context. And so that's a way in terms of this leverage that we have been able to demonstrate that. We also show it in that ultimately by making this investment. It's less expensive for the institution overall. Having a data center that researchers can plug things into. It's more secure. It's cheaper than people going out and building their own data centers. If you can find models for efficient chargeback to researchers where base infrastructure is funded by the institution, but we're augmenting that on top of it with different components from the research side, you can really get better value and leverage across that. I haven't actually done the math, but I think at a minimum, we probably bring in 50% more to the institution of research dollars than we are funded on top of what we're funded directly for. You knew we'd get to security at some point when we're talking to you. So you've worked with Kansak and you've chaired CIRA. How should campuses think about research security differently from enterprise security? So it's all about risk, which is really how you should look at your enterprise security as well. So the answer really isn't all that much different in that context, but taking a look at what is the research being done? What is the sensitivity of the data? And then ultimately making a decision about how can we support that in a way that maximizes the value on the research side and minimizes or accepts makes an acceptable risk decision. So research is risky. There's no question about it. And so finding a model that allows the institution to understand all of those things and then make decisions inside that context is absolutely key. The director of cybersecurity that we have here at our institution is exceptional at this. They will support working with the researcher in the research community, understanding the risk associated with something, and then finding a pathway to yes. Sometimes the pathway to yes is expensive. It involves penetration testing and standing up a secured environment inside AWS or standing up our own local infrastructure that has security controls around it. We're working towards nest 800-171 certification. We've done our self-assessment and have a plan of action. And so all of those things bring in that environment and services to allow us to say more yeses with the right hoops understood that you have to jump through. You know, I just want to follow on that. Do you think with research or a role like yours tucked inside the enterprise or tucked in outside IT that those risk decisions about what's the right, if that's such a word, the right infrastructure or the right conditions that need to be in place in terms of enterprise IT to allow those decisions to be made faster. How do you get that across to researchers to make them understand that somewhat appealing to actually have your research being managed at an enterprise level in terms of your ability to have for speed to execution? Yeah. So I would say two things. You know, you mentioned speed to execution and not one I'm not so sure on. The reality is if there is no requirement for security, then it's faster if you just do it yourself. But what we are seeing in all of what's coming down is there is a requirement from try councils, you know, we do we receive data from the National Institutes from Health. If you want to do anything with GDPR data, any type of all of what's coming through this is an understanding that you need to have the right security controls in place based upon your risk and what you're doing. And so this is coming. Most of the the grants and things that are required sign off it says somebody who doesn't say this, but it's translation in non-legal word is somebody who understands IT and cybersecurity needs to sign off on that. And so that person is in your IT team. It is your CSO or your CSO equivalent or your CIO and they have to be the one that signs off on that. And what that team needs is build towards standards. That's my advice is build towards standards, provide the the the resourcing required to build infrastructure that supports those standards so that your CSO can attest to what they need to attest to. There will be gaps. You will not have everything. It is a research environment. You will get to a question on this 800-171 if you like. Yeah, we can't answer that. No, we can't do that. Or inside that context. And it's okay for your research enterprise to accept that risk and understand that risk in that context. They're the right people to make those decisions inside that context. That's a bit of a segue. Maybe to this next question then. So is there a practical low friction path for campuses to actually participate in national security coordination without overburdening the researchers? Yeah, I would say you build infrastructure that you build digital research infrastructure that meets a standard, whether it be nested 800-171 or Canadian equivalent or otherwise. And so you have a pathway in that. Right now, because of the attestation required, our institution is doing it for our researchers. We can accept a level of risk for our researchers that another institution wouldn't be comfortable accepting inside that context. I will say ultimately the end goal is you have independent organizations that have infrastructure that accept this risk on behalf of multiple institutions and are built for that exact purpose and moving towards that makes it kind of sense. And those have to be independent organizations. They can't be commercial entities because why would they put all of their billions of dollars of assets on the line related to accepting some of these risk. For that same reason, it can't be an institution on behalf of other institutions to put their assets on the line to accept risk for a researcher at a different university. It just doesn't make sense. I want to follow up on this risk discussion just for a second. If you think about that, all the roles or people or parts of the organization within the university that have risk in their context, right? So how do you balance what is the right amount of risk for the enterprise? So you get the whole financial thing, you get your whole reputational thing, you get your research, there's so many elements and we talked about, you know, this is really a risk decision. What's you Calgary been doing to help balance all those stakeholders and all those voices in that risk matrix, I'll call it, to find a way that is, supports the needs of the research, but also manages the needs of appropriate level of enterprise risk. So you've asked a very institutional question and so I can answer it in the institutional way. I will say we're quite fortunate at the University of Calgary and that we're very centrally run, right? It's a very, we've gone through the sort of centralization. I know previous podcast members use different words for that. I'm going to use centralization. And so our teams work quite closely and legal owns a piece of it, privacy owns a piece of it, IT owns a piece of it, and I will say those groups are at the table on a regular and ongoing basis to both recognize who owns what and how we work carefully together. And so legal and privacy and cybersecurity at our institution have a very, very close working relationship where we work through some of these things and pieces. We also then have very clearly defined leadership that owns risk in our organization. So let's say a researcher in coming school of medicine wants to do something where we've managed and checked off every single box in an agreement that we need to accept there's one gap that still provides some level of risk associated with it. First, our director of cybersecurity would make okay, this is a level of risk. I think this is, I'll explain this risk in a way and that gets explained to the CIO as well as the senior leader at that table. So like Dean or AVPR depending upon what it is, we walk through what that risk is in that context and they ultimately sign off on that risk with communicating with the researcher at what that is in that context. I will just say the way that you laughed at my answer on, I'm going to answer this from the institutional context. That's the institutional context. If you can have third parties that you are downloading the risk to, there is significant value in that. And so our director of cybersecurity often is like, is there an organization that has soft to type 2 or some other information security attestation and we can say you're going to do it and be comfortable with what they've got in place. That's great. Let's do that. And so there's sort of two ways in which we can do that. But having those third parties that are willing to accept risk on behalf of our institution will provide significant value to the community and the ecosystem. That's a great answer and I think some of our listeners are really going to appreciate hearing that because I think it gives some great perspective in something for them to consider. Let's switch gears a little bit here. And I want to talk about sovereign compute and cloud trust. So this is where Dana and I might become a level unplugged and unfiltered. Is sovereign compute a real operational requirement for research or mostly a policy political type of conversation? And where does it matter and where is it just noise? So maybe that's a loaded question. Yeah, I think it's a loaded question and it also depends on when you are asking me this question. If you asked me this question four years ago or a year ago or six months ago or a month ago, I would probably answer it in multiple different ways depending upon the time and the case. I will say sovereignty is absolutely a requirement for Canadians in that context. Building up AI sovereign AI capacity to the greatest extent we can, right? Like if you dive into the entire supply chain of AI and all of the different components, no, we're not going to start manufacturing our own chips tomorrow and some of those other aspects. But the more we can build and support a Canadian solution, the better off we will be able to collaborate on a global scale. And so I think this is absolutely a fundamental requirement for us in our environment. And I've given the answer on AI, but I think the same thing exists on cybersecurity and different solutions inside that context. And I will say it's not cheap, right? So like you can't get that by by picking the cheapest solution. But there's a lot of value in what we can get if we work together. That being said, I don't think there is a one-size fits all. Just like I answered in previous, it's, you know, if you were to say, is the answer national infrastructure, local infrastructure, commercial cloud, I would say the answer is all three. Each use case has a different requirement in that space. And so do I think we throw out commercial cloud providers and do everything inside our own? Absolutely not. We leverage all of the tools at our disposal. But we need to take a hard look at making some really good investments in things inside the Canadian context that will benefit us long-term. I'm going to spin a little bit here to one of our favorite words, governance. So how do you structure governance? So the research needs are heard yet the decisions are actually timely. This is a tough one. I would say nobody said it was easy to come on this podcast by the way. Well, I mean, I will note the word governance means so many things to so many people. Like I sit or sat, I no longer sit on this year aboard and the word governance there is big G governance. And then inside an institution governance is like what decisions need to get made? Who needs to make those decisions and the how are they made? And so thinking out the context inside our organization from the research standpoint, the more services and solutions you can build so that the governance is about bigger picture things, right? Like where do we invest our dollar? Where what infrastructure do we invest in? And services do we invest in? So that when each researcher comes along, they're picking the thing they need from a catalog. They're saying, hey, I need some storage to support my active data, you know, sensitive data that I currently have. And they click a button and they have access to it in minute. Or I need some computing and here's my challenge. How do we get them access to something really quickly and easily with the least amount of friction as possible? And then transition them onto national infrastructure when it makes that. And so I will say you invest in services and solutions that support as many needs as you possibly can. So your governance sits at a higher level and the decisions are hidden from the research community. Yeah. And striving for that 80/20. So 80% of the things are easy and 20% of the things are the things that you invest. 80% of your time. Let's move a little bit to what much of this podcast has been about in season one and it will probably be in season two and that's all about the people. We talked a little bit about it, that the start about, you know, technology is interesting, but the fun really is always with the people. So how do you create a culture that supports both operational excellence and researcher responsiveness from a people's perspective? Yeah. So I think you have to have a balance of both kind of understanding what the institutional institution needs, but also understanding that research and that research side of the community. And so here in our team, our research computing team is separate. We talk a lot about researchers, what they're trying to do, how they're trying to do it. We celebrate all the great things they do. I encourage everybody to attend all of the different seminars and things we have across our community. We get to support our Eddie Goldberg research chairs, which were the impact plus chairs. We get to be a part of some of these really great and incredible research things that we enable. And we encourage our team to really understand how cool and exciting this is. On the flip side we sit inside IT and so we spend a lot of time with our IT team and understanding like what are the pain points on the you know the non-research side of the house. Where are the challenges with deploying a major wireless infrastructure refresh across campus or a data center networking refresh across campus and we share those challenges that we see operationally to try and find that right balance between the two. I'll just know it's hard but it's all about people. It's always hard when it's about people I think that's definitely something we see as a as a team but let's let's stay there a little bit and let's talk about sort of the human side of leadership and you've played ultimate at the Masters level very high level last year we had a really great chat with Ray Darling the Red Start University of Waterloo and Ray talked about the leadership traits. He learned playing varsity basketball at Guelph back in the day so this competitive team sport teach leadership lessons that translate into running research IT. I mean the answer is obviously yes because it's all about people and so you are you know so I will say in my when I play on us when I've played on the different teams so I've played competitive ultimate Frisbee for a number of years most recently at the Grand Master level so I the the extra old lady Frisbee as I like to call it and across all of that what I would say is a big part of it is try to be as transparent as you possibly can. So when you're talking about where we're going and what are goals and objectives are we as a team come together and the more we can share about this is what we're planning to do and this is how we're planning to do it the better. I've been on teams where we've said we're just going to go and have fun here and everybody is going to get to play the same amount of time right so you can look at that inside your institution where you're sharing what your goal are and how we're making decisions and being more equitable across across our decisions and resources and then we've had other years where we're like we're going to try and win it all and by the way some people will play and other people will not and coaches will make those decisions that it will be more like a dictatorship and so we aim for both of those there are certain decisions where you know this is what we're doing everybody get behind it here is why and let's move in the same direction and there are other decisions where we say hey we all want to be a part of the direction and where we're going and so I think that has a significant value and benefit on it I will say ultimately the other big part of it is just ensuring you have fun right so I play competitive sports and I do it for one reason and one reason only which is to have fun and inside that environment and that translates into work as well where you should try to find work that you think is fun. All right so this is great so let's wrap up with a few rapid fire questions for you here you know short punchy answers you know the first thing that comes to your mind so I think Dana and I all just bounce back and for us start one piece of advice for a CIO trying to advocate for research on their campus. Find champions key researchers or administrators and then invest in those champions to get them to support you as you go forward. It could change one coordination problem in Canada's research infrastructure tomorrow what would it be? Remove competition we shouldn't be competing on research infrastructure and yet we still do. I love that answer. What's the one capability you'd like to see every campus build in the next three years? So actually have two. First is people who can speak to research but understand enterprise IT so we can build that that gap. No some institutions have this but not all and then the second one which again some institutions have but a deeper understanding on the importance of data management both research data management and administrative data management both are equally important but the context for the two is different. What's the most misunderstood part of the national research infrastructure? So I got two sides to this coin. The first one. You must be in Alberta. This is good. So on one side I see that national research infrastructure will solve all research computing and storage needs and then on the other side it that it will solve nothing and no research computing and storage needs and the reality is it's both. Okay fair I think that's good. One thing you wish that every VP are understood about the CIO. They can be part of the solution. So build a relationship. The biggest misconception about commercial cloud for research? That it doesn't fill a role or a place. So commercial cloud will not replace all HPC. We can't afford it and it's not a good use of our funds but it's expensive for a reason. It fills a role. There are a set of applications that don't fit on national or local infrastructure. Build a solution at your institution if you can that leverages all three. National infrastructure from the Alliance, local infrastructure for local and sensitive workloads and commercial cloud for 24 by seven citizen apps and more. And just a couple more here. The most underrated scale for supporting researchers. Listening and asking questions. Researchers often ask us the wrong questions when they ask for help. So finding the way we can get them to the right question they were supposed to ask and to provide the right solution. Yeah I really like the way you stated that that makes a lot of sense. Last one. A book or podcast you'd recommend to new research IT leaders. So this one was really hard and I ultimately couldn't come up with something specific to the research side. So I'm going to say my favorite two books and apply them in it. The first is radical candor but ultimately any leadership book. Radical candor is my favorite and Dana. So I know. But ultimately don't underestimate the value in building the team and supporting your team. There are many other books if you can pick your favorite one. And then the second book is this is how they tell me the world ends, which is all about cybersecurity. Ultimately at the end you might want to crawl into a hole and never do anything. Again, it is ultimately helped tell the story about why cybersecurity is important. Well I love when you picked radical candor. You knew I would. Yeah for those of you who can't see it, I miss shaking my hands going yay. Jill thanks for joining us. We were so glad to have you as our first guest here on season two. Your perspective from national infrastructure to campus operations is really exactly the kind of practical insight our listeners need. Yeah I think Jill you you gave us so many really interesting things there. I really loved it when you said you know working at the university is one of the hardest jobs that you've ever had. And I think both they and I can attest to that now that we're retired and and that's like oh my God thank you. And and as Janice said this is this is the first recording of the season aside from our sort of intro recording and so thank you for being the guest we meant to have you on since last year and it's great. We're using new technologies so we weren't quite sure how it was going to go but I think it went really well. And you know the end the end product here they're not going to see it but we found a question that could stump Jill and I think that was great. So that was a funny time but we're going to edit that out maybe we'll have a season and blooper session for that. But if you're a CIO of VPR or you know a research leader take Jill's points about people and governance to hire you know technology without the relate right relationships just won't scale. And as always if you've got feedback questions or stories of your own drop us a line at feedback at bytesofexperience.ca that's B-Y-T-S of experience.ca or visit us at bytesofexperience.ca. And special thanks to Pixabee and the Grand Project for the music and to the Cucho LDP for their support. We'll see you next time on Bites of Experience with insights or unfeltured and the coffee is strong. Thanks Jill. (upbeat music)