Police Service of Northern Ireland: Security and Data Protection Breach

Monday 4th September 2023 Commons Chamber

[Mr Speaker]

Before I call the right hon. Member for Lagan Valley (Sir Jeffrey M. Donaldson) to ask the urgent question, I wish to make a short statement about the sub judice resolution. The matter of the data breach is not sub judice, but I have been advised that an individual has been charged with terrorism-related offences following the data breach. While I am content to waive the sub judice resolution in this and other proceedings to allow simple reference to the fact of the arrest, any further discussion of the circumstances of that case would not be in order.

15:40

[Sir Jeffrey M. Donaldson (Lagan Valley) (DUP)]

(Urgent Question): To ask the Secretary of State for Northern Ireland if he will make a statement on the breach of security and data protection at the Police Service of Northern Ireland.

[The Secretary of State for Northern Ireland (Chris Heaton-Harris)]

I thank the right hon. Gentleman for his urgent question. As you know, Mr Speaker, I was keen to do a statement on the Police Service of Northern Ireland’s data breach on 8 August, so I am pleased to have this opportunity. I am also happy to provide an update to the House on this matter. However, since writing this answer, and as the right hon. Gentleman will know, news of the PSNI’s Chief Constable’s resignation has broken over the past few minutes. I thank Simon Byrne for his years of public service. The right hon. Gentleman will know that the appointment of a new Chief Constable is a matter for the Northern Ireland Policing Board, and I will continue to liaise with the senior management team of PSNI while the process of appointing a successor gets under way. The PSNI continues to have my and the Government’s full support in responding to the data breach, and we are focused on providing appropriate and proportionate data and expertise.

The breach, where the personal information of more than 10,000 officers and staff was accidentally published in what appears to be a human error involving a number of spreadsheet fields, happened on 8 August. Not realising that the relevant document contained a hidden table, the initials and surnames of every rank and grade, the location where an individual was based—but not their home address—and their duty type were published online for approximately three hours. The data breach is deeply concerning and significant. Recent events in Northern Ireland, including the terrible attack on Detective Chief Inspector John Caldwell, show that there is still a small minority in Northern Ireland who wish to cause harm to PSNI officers and staff in Northern Ireland. I take this opportunity to thank all those individuals who work to keep the people of Northern Ireland safe. They have my many thanks, and we all owe them our gratitude.

I recognise, too, that there is significant concern about the consequences of this data breach. Many PSNI officers and staff have raised concerns about themselves and their families, and they have my support and understanding as they go about their important work, keeping communities safe in these worrying and most testing of circumstances. To them, I again say thank you.

In response to these concerns, the PSNI and wider security partners are taking appropriate action and are working around the clock to investigate the incident, provide reassurance and mitigate any risk to the safety and security of officers and staff. As of 30 August, 3,954 self-referrals have been made to the PSNI’s emergency threat management group. That is part of the welfare and support services that have been made available to PSNI officers.

The House will understand that the PSNI is devolved and has operational independence. That has been the case since April 2010 with the creation of the Department of Justice. However, as the House would expect, the Government have remained in close contact with the PSNI since this breach and other data breaches came to light. My officials and I have been receiving regular updates and the Government’s focus has been on providing specialist support and expertise to the PSNI in its handling of this issue. Officials in the Cabinet Office have chaired—[Interruption.] I will finish in a second, Mr Speaker. Officials in the Cabinet Office have chaired regular meetings, and I will update the House further, hopefully during this urgent question.

[Sir Jeffrey M. Donaldson]

Thank you, Mr Speaker, for the opportunity to raise the plight of police officers and staff in Northern Ireland. The industrial-scale breach in data last month was yet another self-inflicted blow to the morale of the police service, as well as to confidence in policing across Northern Ireland. For the rank and file, and for the staff working in our police stations, for their personal details to be released into the public domain and to find their way into the hands of dissident republicans is unforgivable.

The current terrorist threat level in Northern Ireland is “severe.” Just a few months ago, Detective Chief Inspector John Caldwell was barbarically attacked by gunmen in front of his young son after coaching an under-15s football team near Omagh. Now, each one of his colleagues must come to terms with the fact that they and their families have potentially been placed in harm’s way by the release of this data.

It goes further than that. Last week’s ruling by Mr Justice Scoffield found that the PSNI’s senior command unlawfully disciplined two of its own officers in order to appease Sinn Féin. These actions are hugely damaging to community relations, to community confidence and to confidence in the rule of law in Northern Ireland. Fair and even-handed policing is just as foundational to progress in Northern Ireland as is fully functioning political institutions operating on a cross-community consensus basis. We therefore need to hear from the Government that they will ensure that the necessary resources are available to the police—notwithstanding budgetary constraints—so that police officers, their families and police staff are properly protected against terrorist attack.

Furthermore, the Democratic Unionist party welcomes the decision by the chief constable to announce his resignation. We believe that is the right thing to do in all the circumstances. Now we want to see confidence rebuilt in our police service, and we will work with the PSNI—it has our full support—to achieve and deliver effective and efficient policing for everyone in Northern Ireland in a way that commands cross-community support.

[Chris Heaton-Harris]

I thank the right hon. Gentleman again for the urgent question and for the various questions he has posed. Officials in the Cabinet Office have chaired regular operational meetings—initially daily—bringing together the PSNI, Government Departments and our world-class security services to ensure that all their collective skills, including cyber-expertise, have been brought to bear in supporting the PSNI on the breach.

You will appreciate, Mr Speaker, that given your ruling on sub judice and for security reasons, I cannot comment on specific details of the response, but six individuals have been arrested by detectives investigating the breach and the criminality connected to it. Five have been released on bail to allow for further police inquiries and one has been charged with possessing documents or records likely to be useful to terrorists, and another item.

The right hon. Gentleman mentioned money. The response to such a significant breach will obviously come with a cost. The UK Government are clear that security is paramount, and the focus remains on support and expertise at this point. With Northern Ireland’s policing being devolved, it is for the Department of Justice to set its budget and ensure it can fulfil its duties and responsibilities, but it still remains a fundamental responsibility of the Executive—in their absence, Northern Ireland Departments—to run a balanced and sustainable budget. Where additional funding is required, the correct process, which includes a whole host of different things, must be followed. However, I completely understand the right hon. Gentleman’s point.

[Theresa Villiers (Chipping Barnet) (Con)]

This whole episode is agonising. I want to put on record my support and sympathy for all those brave men and women of the PSNI who fear for their security and that of their families as a result. I urge the Secretary of State to do everything possible with the PSNI to ensure that documents of this sensitivity are subject to sufficient protection so that a mistake of this sort can never ever be made again.

[Chris Heaton-Harris]

I think that the right hon. Member for Lagan Valley (Sir Jeffrey M. Donaldson) referred to it in his question as a “self-inflicted” wound, and it surely was. To be frank, checks and balances should have been in place. I completely agree with my right hon. Friend, and we will do what we can to assist the PSNI and the Department of Justice, as she would expect. We keep abreast of these matters, as I hope I detailed in my answers, but this is a really significant breach. As one police officer put it to me, “When I joined the police service, I used to think when I went to work that maybe people knew what I did for a living, but now that has completely flipped—I feel that they absolutely know what I do for a living.” That has changed the psychology around the whole piece. I know that a lot more assurances need to be given for us to get to the place that my right hon. Friend wishes to get to.

[Mr Speaker]

I welcome the new shadow Secretary of State.

[Hilary Benn (Leeds Central) (Lab)]

May I say that I look forward to working with the Secretary of State in the interests of peace, prosperity and progress in Northern Ireland?

The release of the names and workplaces of thousands of PSNI officers and staff was doubtless inadvertent, but its consequences could not be more serious. That has now been recognised by the chief constable, Simon Byrne, who is resigning—I join the Secretary of State in thanking him for his service. Those who serve in the PSNI confront great risks every day in their job to keep the public safe, and we thank them. But they already knew that dissident republicans were targeting them and their families, and now they know that those who would do them harm have this list. The damage to morale and confidence should not be underestimated. They are asking urgently, “What will be done to reassure and protect us?”

Does the Secretary of State agree that the inquiry needs to be completed as quickly as possible? Can he confirm that he will approve the appointment of the new chief constable in the absence of a Justice Minister in Northern Ireland? Does he intend to review the operation of the Northern Ireland Policing Board and how it functions? Does he recognise that there will be additional costs in protecting staff, as well as responding to potential civil claims? There were already great pressures on the Northern Ireland policing budget, and the cuts it now faces will, in the words of the PSNI, leave the service “smaller…less visible, less accessible and less responsive”.

Finally, the whole House wants to ensure that the staff get the support, protection and reassurance they need, but to succeed in doing that we need leadership from the Government and the political parties in Northern Ireland, to get the Assembly and the Executive up and running again as quickly as possible.

[Chris Heaton-Harris]

I welcome the right hon. Gentleman to his place and look forward to working with him. As I mentioned outside the Chamber, I will happily brief him on any aspects and will arrange technical briefings from my officials so that he can be brought up to speed quickly. I would like to put on record my thanks to the former shadow Secretary of State, the hon. Member for Hove (Peter Kyle), who is present, for the way he went about his business and for the very co-operative way we dealt with business. I appreciate it and wish him well as we move forward.

The right hon. Gentleman asked about the inquiry. Yes, it needs to be expedited. A timetable has been set up by the Policing Board, which is independent, and I believe that it reports in three months’ time. It is quite a fundamental inquiry, and I hope in that time it will be able to bring all the answers required to the table. He asked about the appointment of a future chief constable; if the institutions of the Executive and the Minister for Justice are not present, we will have to pass secondary legislation in this place to allow that to happen. All that depends on the Policing Board going about its business and recruitment—I believe that is very much a rubber stamp of its work.

The right hon. Gentleman asked about the Policing Board and reform. I spoke to a number of board members before the resignation of the chief constable, and they all know that the spotlight is on them and how they deal with this. I would like to wait and see how they discharge their duties over the course of the next few weeks before I commit to reform, because there are good people there who have the ability to do the job.

Finally, on the budget, which I mentioned in my answer, the right hon. Gentleman forgot to mention that the Information Commissioner will come out with a decent fine for the data breach. We will have to take a whole host of things into account. As and when they materialise, we will look at them.

[Shailesh Vara (North West Cambridgeshire) (Con)]

The Secretary of State mentioned the independence of the PSNI, and that funding issues lie with the Department of Justice and the Northern Ireland Executive, but may I press him on this issue? Will he use his considerable influence to ensure that the safety of all people is first and foremost, and not the cost? It is important that the influence he has is exerted to its fullest, because these are good people who find themselves in a very, very difficult position through no fault of their own.

[Chris Heaton-Harris]

I like to feel that I have considerable influence in Government, but I am not sure that is completely correct. However, I will use the influence I have to do the right thing by all those who work for the PSNI. All sorts of issues have come up over the past 25 years and since policing was devolved, but policing in Northern Ireland certainly seems to look and feel better, and it is beginning to get good outcomes for those who are being policed. I can only praise the officers and say that I will do everything in their support.

[Mr Speaker]

I call the SNP spokesperson.

[Richard Thomson (Gordon) (SNP)]

I join the Secretary of State in offering my thanks to Simon Byrne for his service. I believe his decision today, however, is the right one. This represented a shocking breach of confidentiality not just in relation to people’s personal data, but a shocking breach in the confidence that PSNI officers and staff can have in the organisation. I pay tribute to the dedicated PSNI officers and staff who daily protect and serve the people of Northern Ireland.

The PSNI, as has been alluded to, is already suffering a crisis of funding and therefore resourcing. The officer complement is lower than it has been in the police service serving Northern Ireland than at any point since 1979. The UK Government pay £30 million a year in additional funding to meet the security challenge, but that funding was inadequate even before the breach and is surely even more inadequate now. Will the Secretary of State be a little clearer on exactly how he will give funding guarantees to the PSNI going forward, because I do not believe this is something where the buck can be passed entirely to those who are currently charged with administering devolved budgets?

[Chris Heaton-Harris]

I thank the hon. Gentleman for his question. He talks about the additional security funding that the Government put in. The UK Government’s contribution to the financial year 2022-23 is £32 million in this space. The cost implications of the PSNI response are rightly being discussed with the Department of Justice. Any additional asks for funding would come through an established process. While it would not be right for me to pre-empt that, the Government are clear that security is paramount. Our focus remains currently on the asks that have been made of us, which are to provide specialist support and expertise in response to the latest assessment.

[Julian Smith (Skipton and Ripon) (Con)]

PSNI officers face significant physical risks, but they also face significant reputational and relationship risk when they are revealed to be members of the PSNI. The Catholic Police Officers Guild and the Police Federation for Northern Ireland have done brilliant work over the past few weeks. Will the Secretary of State confirm that he is engaging with those organisations as the Government seek to support the impact of the breach?

[Chris Heaton-Harris]

I have not yet spoken to the Catholic Police Officers Guild personally, but my officials have done so on a number of occasions and I am very happy to do so. Initially, we were receiving high-level briefings from the chief constable and his senior management team, and, as I mentioned, the Cabinet Office committee that was set up was receiving and imparting information at an officer level. We are at the beginning of the process, so there is still a very long way to go. The PSNI will have to reflect on today’s news of the chief constable’s resignation. There is a lot more for the Government and the Secretary of State to do in this space, and I fully recognise that.

[Colum Eastwood (Foyle) (SDLP)]

I think that Simon Byrne has made absolutely the right decision in resigning today, given everything that has happened in recent weeks. However, there is a much deeper and more significant problem than just one individual, and it is one about which we have been warning for years: the real crisis in the recruitment and retention of Catholic PSNI officers and staff. Does the Secretary of State agree that the best way of dealing with that crisis is to bring back 50:50 recruitment?

[Chris Heaton-Harris]

During a conversation I had with the hon. Gentleman last week, he talked about the Patten reforms and 50:50 recruitment, and said it had been a backward step to depart from that point. I am a great believer in the original principle of policing, in Peelism, whereby a police force reflects the community that it polices. That is how it gains its confidence. I may be mistaken, but I think I was briefed recently that there had been good levels of recruitment to the PSNI from Catholic communities, but situations such as the one we are discussing today damage the prospects of that continuing, and it is our job—the job of all of us—to ensure that that does not happen.

[Sir Robert Buckland (South Swindon) (Con)]

If anyone was in any doubt about the particularly difficult and sensitive role played by police officers in Northern Ireland, they should not be in any doubt now following this appalling incident. Has my right hon. Friend been satisfied thus far that within the PSNI, suitable measures have already been taken to ensure that freedom of information and subject access requests are dealt with by people of sufficient seniority, and that there is vetting and double-checking of information before it is disclosed into the public domain?

[Chris Heaton-Harris]

I thank my right hon. and learned Friend for his wise question, and I can give him that assurance. The processes behind the issuing of freedom of information answers have been very well checked and will, I am sure, be checked and checked and checked again—and, I believe, simplified, with much more senior eyes making sure that information goes out correctly.

[Karin Smyth (Bristol South) (Lab)]

I was in Northern Ireland during the week after the breach, and the fact that officers continued to go out and go about their duties is a testament to them and their service. However, it is unacceptable that the job they do remains a secret from many people, and that we somehow think this is normal in Northern Ireland 25 years after the peace process; it would not be normal in any other part of the United Kingdom, or in Ireland. What is the Secretary of State doing with the co-guarantors of the peace process, the Irish Government, and those in the field more widely to deal with what is now clearly a crisis?

[Chris Heaton-Harris]

I personally agree entirely with the first part of what the hon. Lady has said. Policing should be much more normalised in Northern Ireland, as, indeed, life should be. However, there is an interesting, rich and troubled history in Northern Ireland that has led us to where we are now. What the Chief Constable did in introducing community policing means that the hon. Lady will be able to walk around all sorts of places and have the sense of a much more normal policing experience.

I have had conversations with my Irish counterparts, although this is very much an issue that rests with the UK Government, but everyone is interested in how freedom of information requests are now dealt with.

[Stephen Farry (North Down) (Alliance)]

I, too, thank Simon Byrne for his service, and join others in recognising that in the current circumstances he made the right decision in resigning, given that his position was no longer tenable. On the issue of the data breach, can the Secretary of State assure the House that money will be no obstacle in the short run when it comes to the relocation of any officer? There will be people, particularly those from a Catholic nationalist background who are operating in intelligence and highly sensitive security roles, who are particularly exposed, alongside everyone else who is at risk. Can the Secretary of State assure us that there will be no barriers to ensuring their safety, which is paramount?

[Chris Heaton-Harris]

I must be careful about how I answer that question, because it relates very much to security matters, but I think I can say that the hon. Gentleman is correct in assuming what he assumes.

[Dame Meg Hillier (Hackney South and Shoreditch) (Lab/Co-op)]

I am heartened by the Secretary of State’s commitment to money and support for his officers, although money cannot put this right. Ministers come and go, as do Governments, so will he also commit himself to giving regular and confidential updates to, perhaps, the Intelligence and Security Committee or the Northern Ireland Affairs Committee on the ongoing costs? There is a danger that while there is a long-term risk for officers, short-term Government thinking can mean that support of this kind can wither on the vine.

[Chris Heaton-Harris]

I will happily find out the appropriate way of reporting, as the hon. Lady suggests. As I have said, I think this is going to have a very long tail, so the ramifications as it plays out will ripple through the system for a very long time indeed.

[Gavin Robinson (Belfast East) (DUP)]

On behalf of my colleagues, I welcome the new shadow Secretary of State to his place. I look forward to working with him. I also thank his predecessor for all his efforts to engage with us.

It is important to correct a number of inaccuracies in the Secretary of State’s response. There was no hidden table but, as is common with Excel spreadsheets, there was more than one field. There was human error, but there were five levels of security to assess what was going out, all of which failed. That speaks to systemic failure within the PSNI. I welcome the resignation of the Chief Constable this afternoon and I think it is important that collectively—politically and in society—we all work together. I hope the Secretary of State will support us in this to instil confidence again in the Police Service of Northern Ireland.

[Chris Heaton-Harris]

I did not know that the hon. Gentleman was such an expert in Excel. I am certainly not, so I am happy to be corrected by him on the detail of that, but I think my statement was pretty thorough and I agree with what he says.

[Jamie Stone (Caithness, Sutherland and Easter Ross) (LD)]

As some Members will know, my wife comes from County Armagh. We got married at the height of the troubles—the bombings and the shootings—and it sent a chill down my spine when I read of this leak. First, the hon. Member for Foyle (Colum Eastwood) has referred to the difficulty of recruiting to the Police Service of Northern Ireland, and this will only make it worse. Secondly, it will not do much for our relationship with the police in the Republic of Ireland. The danger is that we just say that this is a matter for the PSNI and take a view from across the Irish sea, but Northern Ireland is a constituent part of the United Kingdom and I hope that a United Kingdom solution will be sought involving police forces on this side of the Irish sea and, if necessary, the UK’s intelligence services to find out what happened.

[Chris Heaton-Harris]

The hon. Gentleman is absolutely correct. That is why I detailed the meetings of officials in the Cabinet Office, who have chaired a large number of regular operational meetings bringing together the PSNI, Government Departments and world-class cyber-security experts to ensure that all our collective skills across the Union are galvanised in this space.

[Sammy Wilson (East Antrim) (DUP)]

I welcome the resignation of the Chief Constable. It is a pity it took so long. I think he saw that the writing was on the wall when he knew a motion was going to the Policing Board calling for his resignation, and so he should. He has lost the confidence of officers, not just because of this data breach but because he was prepared to throw two junior officers to the wolves in order to placate Sinn Féin, and it is right that he should go.

The Secretary of State has been a bit confusing in his answers about money. He says that he recognises there will be considerable expenditure involving the Information Commissioner, mitigation measures, the relocation of officers and so on. On one hand, he says that this will have to come from the Justice Department budget, but on the other hand, he seems to indicate that the Government recognise that there will be additional expenditure for the police. Given that the police are already 600 officers under strength, will he give a commitment that any additional costs as a result of this will not have to come from the existing overstretched budget?

[Chris Heaton-Harris]

I thank the right hon. Gentleman for his question. I hope he will forgive me for pushing back slightly, but I think I have been particularly clear on this, and all of this could be solved much more easily if there were an Executive in place. I very much hope that that happens.

[Claire Hanna (Belfast South) (SDLP)]

The last few weeks have been hugely damaging to hard-won progress in our still fragile society. Ordinary officers are feeling vulnerable and demoralised, and we are thinking of them and also of the families of the victims of the Sean Graham murders, who have been thrust into a political row that they did not seek due to a heavy-handed response. In the interests of officer morale and impartial policing, it is important that we know, following that Ormeau Road incident, who in the Northern Ireland Office spoke to the Chief Constable and, when the issue came up of Sinn Féin withdrawing from the Policing Board, what the NIO said to the Chief Constable.

[Chris Heaton-Harris]

If the hon. Lady would kindly nod to indicate whether she means in the last couple of weeks—[Interruption.] I am afraid I will have to come back to her with that answer, if I may, because I do not have those details.

[Jim Shannon (Strangford) (DUP)]

I thank the Secretary of State for his response.

Ever mindful that this is a practical, physical issue for my constituents, will the Secretary of State outline what additional support and help is to be made available to PSNI officers who are under threat and whose families feel unsafe in their homes? Over my 38 years as an elected representative—as a councillor, an Assembly Member and a Member of Parliament—a number of RUC and PSNI officers have come to me in need of assistance after being threatened. That assistance was available fairly urgently. Will the Secretary of State confirm that a budget is available to rehouse, as a priority, those 10,799 police officers and civilian staff who are under threat, taking into consideration those who have moved from one district to another for safety reasons? They feel open and vulnerable to attack, and an apology is simply not enough to allow them to lie safely in their bed at night. What is needed is a practical, physical solution. That is what I am asking for.

[Chris Heaton-Harris]

I thank the hon. Gentleman for his question, and for the way he puts it. We are currently at a stage where officers and staff who have a concern are reporting it to their senior management, and a triage process has been in place. As of 30 August, 3,954 people have self-referred to the emergency threat management group within PSNI.

If the hon. Gentleman will forgive me, I am very wary of mentioning security matters for those at highest risk, so I will not do so. There is a continuing process to make sure PSNI has both the budget and the process available to ensure that extra security measures can be taken, and to ensure there is extra training and conversations to reassure people. It will be a little while before we see much upward pressure on budgets, and I will then happily update the House.