Asked by: Pam Cox (Labour - Colchester)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, how many prisoners are participating in higher education courses.
Answered by Jake Richards - Assistant Whip
According to the Open University, as of 18 December 2025, there are 1,486 students who are currently in custody enrolled on Open University higher education programmes for the 2025/26 academic year, and a further 413 on licence in the community, totalling 1,899.
Additionally, some prisoners are taking level 4 courses, with 1,524 prisoners currently studying a course funded by the Prisoners’ Education Trust.
Asked by: Pam Cox (Labour - Colchester)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, how many prisons and Young Offender Institutions currently have (a) an Incentivised Substance Free Living Unit operating, (b) a Drug Recovery Wing operating, and (c) a Drug Strategy Lead in post.
Answered by Jake Richards - Assistant Whip
HM Prison & Probation Service (HMPPS) has funded Incentivised Substance Free Living Units in 85 prisons, and six currently have abstinence-based Drug Recovery Wings. To support delivery of HMPPS’ Drug and Alcohol Strategy, 54 prisons have a dedicated Drug Strategy Lead. All remaining prisons, including Young Offender Institutions, have a designated point of contact for Drug and Alcohol Strategy work.
In addition, HMPPS has recruited 17 Group Drug and Alcohol Leads providing regional leadership, assurance, and co-ordination of drug and alcohol work for all the establishments in their Prison Group. They align activity at establishment level with national drug and alcohol strategy and policies which aim to restrict supply, reduce demand and support recovery. They also support local and regional partnerships with healthcare providers to support a range of issues including continuity of care on release.
Asked by: Pam Cox (Labour - Colchester)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, how many foreign national offenders were in prison in England and Wales, by offence group as of 30 September 2025.
Answered by Jake Richards - Assistant Whip
A breakdown of Foreign National Offenders (FNOs) by offence group is published in the Annual prison population statistics and the most recent publication can be found here: prison-population-2025.ods. Please see Table_1_A_26, which shows the breakdown as of 30 June 2025.
As these statistics are published annually, we are not able to provide a breakdown as of September.
In the last year, we removed over 2,700 FNOs under the Early Removal Scheme, that is more than the number removed in the previous year, and a 74 percent increase compared to the same period in 2023. It will free up much-needed space in our prisons.
Asked by: Pam Cox (Labour - Colchester)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, how many Prison Transfer Agreements are currently in place.
Answered by Jake Richards - Assistant Whip
The UK has Prisoner Transfer Agreements (PTAs) with over 110 countries. They allow for the transfer of Foreign National Offenders (FNOs) to their country of nationality to serve the remainder of their sentence, and the repatriation of British Citizens imprisoned overseas.
There are two types of PTA, compulsory meaning the FNO does not need to consent to transfer, and voluntary which means they do. In either case both countries must agree each transfer.
Asked by: Shaun Davies (Labour - Telford)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, what assessment he has made of his Department's progress towards its target of increasing prison capacity.
Answered by Jake Richards - Assistant Whip
This Government inherited a prison system in collapse. We have taken decisive action to put prison capacity on a sustainable footing and end the cycle of repeated crises.
We have committed to the largest expansion of the estate since the Victorians, investing £7 billion in building prison places between 2024/25 and 2029/30. We are on track to deliver 14,000 new prison places by 2031 with c. 2,900 delivered already under this Government.
On top of this, we have introduced landmark sentencing reforms to end our prisons crisis – and deliver punishment that cuts crime. On 2 September we introduced the Sentencing Bill to take forward most of the recommendations made by David Gauke’s Independent Sentencing Review, as well as the measures that go further to manage offenders in the community. The House of Lords committee stage was concluded on 3 December.
Asked by: Vikki Slade (Liberal Democrat - Mid Dorset and North Poole)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, if he will make it his policy to review the status of people held on remand in custody for more than six months to determine whether they should be considered for conditional release.
Answered by Jake Richards - Assistant Whip
The decision to remand an individual in custody or to grant bail is solely a matter for the independent judiciary acting in accordance with the Bail Act 1976. With limited exceptions, the Bail Act creates a presumption in favour of bail for defendants involved in criminal proceedings. This recognises that a person should not be deprived of his/her liberty unless that is necessary for the protection of the public or the delivery of justice.
There is a well-established process that enables remanded prisoners to apply to the court for bail, and we have expanded the Bail Information Service over the last year to provide more support.
Asked by: Vikki Slade (Liberal Democrat - Mid Dorset and North Poole)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, what data his Department holds on the length of time spent in detention without trial by defendants charged under the Terrorism Act 2000 for (a) supporting or (b) being a member of Palestine Action.
Answered by Jake Richards - Assistant Whip
No-one is being detained under the Terrorism Act 2000 for supporting, or being a member of, Palestine Action.
Asked by: Marie Rimmer (Labour - St Helens South and Whiston)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, what assessment he has made of the adequacy of disaster recovery planning at the Legal Aid Agency prior to the cyber-attack of April 2025.
Answered by Sarah Sackman - Minister of State (Ministry of Justice)
We take the security of people’s personal data extremely seriously.
Firstly, to ensure transparency about the cyber- attack and that we reached as many potentially impacted individuals as possible, the Ministry of Justice published a notice shortly after it became aware of the criminal cyber-attack at 08:15 on 19 May on GOV.UK
The notice provided information about the cyber-attack and directed concerned members of the public to the National Cyber Security Centre’s webpage, which contained information on how to protect against the impact of a data breach.
The Legal Aid Agency (LAA) also set up dedicated Customer Services support via a telephone line and email for providers and clients who had concerns regarding the data breach. We did not write to all clients, to all the addresses that we had, because some of those addresses would no longer be current, and that would potentially create another data breach in itself.
The published statement referred to above sets out information about who may have been impacted and the nature of the information which may have been accessed. As far as we are aware, no data has been shared or put out in the public domain. An injunction has been put in place to prohibit sharing of this data. Anyone who does so could be sent to prison. If it is identified that a specific individual is at risk, action will be taken to try to contact them.
In the interests of security, we cannot confirm the method by which unauthorised access was gained to the LAA’s online digital systems or details about specific steps taken or measures implemented to protect LAA systems against any future cyber-attacks.
Security of the new systems has been paramount as we have rebuilt the LAA’s digital systems following the attack. The compromised digital portal has been replaced by a new, secure single sign-in tool for LAA online services (SiLAS). SiLAS has been designed and built in line with UK government and industry best practice for secure development. Security has been included from the ground up, including multi factor authentication, with independent testing activities to validate that the appropriate security controls are in place.
A dedicated team will monitor and update the service to ensure it evolves to remain resilient to emerging threats and is supported by a security operations capability. While no system can be entirely risk free, we are confident that we have taken the right steps to protect the service and its users.
Responsibility for disaster recovery planning for digital systems lies with Justice Digital rather than the LAA. Prior to the cyber- attack there was no digital disaster recovery plan in place. However, had we had a fully funded disaster recovery system, any immediate restoration would have simply restored the systems without resolving the vulnerabilities that enabled the cyber- attack to occur. Justice Digital now have a new Service Owner structure in place where clear Service Standards will be defined and monitored. This will include digital disaster recovery plans for each digital product.
Prior to the cyber- attack the LAA had in place prepared business continuity plans for business-critical processes and services to ensure that access to justice could be maintained in the event of a system outage. These plans were tried and tested, and we were confident that the measures would be effective for our initial response. These measures gave us sufficient time to design and implement longer term measures to meet the specific needs of the incident that were introduced in June 2025.
At every stage, we have acted to protect public access to justice and to support providers in delivering legal aid. We have achieved this without affecting court backlogs or police station activity.
Our business continuity planning was effective in maintaining access to justice from the outset of the attack and the need to have longer term options in place is one of the lessons that we have taken from this incident.
A formal lessons learned approach will systematically analyse lessons from the Ministry of Justice’s and LAA’s preparation for and response to the cyber-attack. This work will cover pre-incident risk management and the response to the incident itself. This will inform future resilience planning, governance improvement and risk mitigation strategies across the Ministry of Justice and its agencies.
Asked by: Marie Rimmer (Labour - St Helens South and Whiston)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, after the April 2025 data breach of the Legal Advice Agency, what specific steps have been taken, and what further measures are planned, to ensure that a similar security breach does not occur again.
Answered by Sarah Sackman - Minister of State (Ministry of Justice)
We take the security of people’s personal data extremely seriously.
Firstly, to ensure transparency about the cyber- attack and that we reached as many potentially impacted individuals as possible, the Ministry of Justice published a notice shortly after it became aware of the criminal cyber-attack at 08:15 on 19 May on GOV.UK
The notice provided information about the cyber-attack and directed concerned members of the public to the National Cyber Security Centre’s webpage, which contained information on how to protect against the impact of a data breach.
The Legal Aid Agency (LAA) also set up dedicated Customer Services support via a telephone line and email for providers and clients who had concerns regarding the data breach. We did not write to all clients, to all the addresses that we had, because some of those addresses would no longer be current, and that would potentially create another data breach in itself.
The published statement referred to above sets out information about who may have been impacted and the nature of the information which may have been accessed. As far as we are aware, no data has been shared or put out in the public domain. An injunction has been put in place to prohibit sharing of this data. Anyone who does so could be sent to prison. If it is identified that a specific individual is at risk, action will be taken to try to contact them.
In the interests of security, we cannot confirm the method by which unauthorised access was gained to the LAA’s online digital systems or details about specific steps taken or measures implemented to protect LAA systems against any future cyber-attacks.
Security of the new systems has been paramount as we have rebuilt the LAA’s digital systems following the attack. The compromised digital portal has been replaced by a new, secure single sign-in tool for LAA online services (SiLAS). SiLAS has been designed and built in line with UK government and industry best practice for secure development. Security has been included from the ground up, including multi factor authentication, with independent testing activities to validate that the appropriate security controls are in place.
A dedicated team will monitor and update the service to ensure it evolves to remain resilient to emerging threats and is supported by a security operations capability. While no system can be entirely risk free, we are confident that we have taken the right steps to protect the service and its users.
Responsibility for disaster recovery planning for digital systems lies with Justice Digital rather than the LAA. Prior to the cyber- attack there was no digital disaster recovery plan in place. However, had we had a fully funded disaster recovery system, any immediate restoration would have simply restored the systems without resolving the vulnerabilities that enabled the cyber- attack to occur. Justice Digital now have a new Service Owner structure in place where clear Service Standards will be defined and monitored. This will include digital disaster recovery plans for each digital product.
Prior to the cyber- attack the LAA had in place prepared business continuity plans for business-critical processes and services to ensure that access to justice could be maintained in the event of a system outage. These plans were tried and tested, and we were confident that the measures would be effective for our initial response. These measures gave us sufficient time to design and implement longer term measures to meet the specific needs of the incident that were introduced in June 2025.
At every stage, we have acted to protect public access to justice and to support providers in delivering legal aid. We have achieved this without affecting court backlogs or police station activity.
Our business continuity planning was effective in maintaining access to justice from the outset of the attack and the need to have longer term options in place is one of the lessons that we have taken from this incident.
A formal lessons learned approach will systematically analyse lessons from the Ministry of Justice’s and LAA’s preparation for and response to the cyber-attack. This work will cover pre-incident risk management and the response to the incident itself. This will inform future resilience planning, governance improvement and risk mitigation strategies across the Ministry of Justice and its agencies.
Asked by: Marie Rimmer (Labour - St Helens South and Whiston)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, with reference to the the Legal Advice Agency data breach in April 2025, whether his Department and the LAA had a prepared disaster recovery plan prior to the breach.
Answered by Sarah Sackman - Minister of State (Ministry of Justice)
We take the security of people’s personal data extremely seriously.
Firstly, to ensure transparency about the cyber- attack and that we reached as many potentially impacted individuals as possible, the Ministry of Justice published a notice shortly after it became aware of the criminal cyber-attack at 08:15 on 19 May on GOV.UK
The notice provided information about the cyber-attack and directed concerned members of the public to the National Cyber Security Centre’s webpage, which contained information on how to protect against the impact of a data breach.
The Legal Aid Agency (LAA) also set up dedicated Customer Services support via a telephone line and email for providers and clients who had concerns regarding the data breach. We did not write to all clients, to all the addresses that we had, because some of those addresses would no longer be current, and that would potentially create another data breach in itself.
The published statement referred to above sets out information about who may have been impacted and the nature of the information which may have been accessed. As far as we are aware, no data has been shared or put out in the public domain. An injunction has been put in place to prohibit sharing of this data. Anyone who does so could be sent to prison. If it is identified that a specific individual is at risk, action will be taken to try to contact them.
In the interests of security, we cannot confirm the method by which unauthorised access was gained to the LAA’s online digital systems or details about specific steps taken or measures implemented to protect LAA systems against any future cyber-attacks.
Security of the new systems has been paramount as we have rebuilt the LAA’s digital systems following the attack. The compromised digital portal has been replaced by a new, secure single sign-in tool for LAA online services (SiLAS). SiLAS has been designed and built in line with UK government and industry best practice for secure development. Security has been included from the ground up, including multi factor authentication, with independent testing activities to validate that the appropriate security controls are in place.
A dedicated team will monitor and update the service to ensure it evolves to remain resilient to emerging threats and is supported by a security operations capability. While no system can be entirely risk free, we are confident that we have taken the right steps to protect the service and its users.
Responsibility for disaster recovery planning for digital systems lies with Justice Digital rather than the LAA. Prior to the cyber- attack there was no digital disaster recovery plan in place. However, had we had a fully funded disaster recovery system, any immediate restoration would have simply restored the systems without resolving the vulnerabilities that enabled the cyber- attack to occur. Justice Digital now have a new Service Owner structure in place where clear Service Standards will be defined and monitored. This will include digital disaster recovery plans for each digital product.
Prior to the cyber- attack the LAA had in place prepared business continuity plans for business-critical processes and services to ensure that access to justice could be maintained in the event of a system outage. These plans were tried and tested, and we were confident that the measures would be effective for our initial response. These measures gave us sufficient time to design and implement longer term measures to meet the specific needs of the incident that were introduced in June 2025.
At every stage, we have acted to protect public access to justice and to support providers in delivering legal aid. We have achieved this without affecting court backlogs or police station activity.
Our business continuity planning was effective in maintaining access to justice from the outset of the attack and the need to have longer term options in place is one of the lessons that we have taken from this incident.
A formal lessons learned approach will systematically analyse lessons from the Ministry of Justice’s and LAA’s preparation for and response to the cyber-attack. This work will cover pre-incident risk management and the response to the incident itself. This will inform future resilience planning, governance improvement and risk mitigation strategies across the Ministry of Justice and its agencies.