The Police Service of Northern Ireland (PSNI) is investigating after information about its current employees was posted online on Tuesday, August 8.
PSNI's Assistant Chief Constable Chris Todd, Senior Information Risk Owner, said on Wednesday that the investigation into Tuesday's "significant data breach of personal details of our officers and staff" is ongoing.
"I can confirm that following a routine Freedom of Information (FoI) request, data contained within a spreadsheet was published on a legitimate FoI website," ACC Todd said in a statement.
"This included the surname, initials, rank/grade, role, and location of all serving officers and staff.
"This data was available to view on the website for a period of up to three hours before it was removed."
The information about a reported 10,000 officers and staff was included in the breach.
The breach has been declared a "critical incident," ACC Todd said, who added that the service is "working hard to do everything we can to mitigate any risk."
ACC Todd said the PSNI has issued "updated personal security advice" to all officers and staff and established an "emergency threat assessment group that will look at the welfare concerns of our people."
He added: “We have also sought the assistance of an Independent Advisor to conduct an end to end review of our processes in order to understand what happened, how it happened, and what we can do immediately to prevent such a breach happening in the future."
ACC Todd added: “This is an extremely serious situation.
"The Chief Constable [Simon Byrne] is cutting his family holiday short and returning to Northern Ireland to attend tomorrow’s special sitting of the Northern Ireland Policing Board.
"We will continue to keep the Information Commissioner’s Office updated as the investigation continues.”
In a subsequent update on Wednesday, ACC Todd said police are investigating the circumstances surrounding the theft of documents, including a spreadsheet containing the names of over 200 serving officers and staff, along with a police issue laptop and radio, from a private vehicle in the Newtownabbey area on July 6.
"We have contacted the officers and staff concerned to make them aware of the incident and an initial notification has been made to the office of the Information Commissioner regarding the data breach," ACC Todd said.
The PSNI first confirmed the data breach in a statement on Tuesday, August 8, which noted that the information posted online was "taken down very quickly."
"Although it was made available as a result of our own error, anyone who did access the information before it was taken down is responsible for what they do with it next," ACC Todd said.
"It is important that data anyone has accessed is deleted immediately."
ACC Todd acknowledged in a press briefing on Tuesday that "we operate in an environment at the moment where there is a severe threat to our colleagues in Northern Ireland related to terrorism and this is the last thing that anyone wants to be hearing."
Liam Kelly, the Chair of the Police Federation for Northern Ireland, expressed dismay and anger and insisted on an urgent inquiry.
“This is a breach of monumental proportions," Kelly said in a statement on Tuesday. "Even if it was done accidentally, it still represents a data and security breach that should never have happened.
“Rigorous safeguards ought to have been in place to protect this valuable information which, if in the wrong hands, could do incalculable damage.
“The men and women I represent are appalled by this breach. They are shocked, dismayed and justifiably angry. Like me, they are demanding action to address this unprecedented disclosure of sensitive information.
“We have many colleagues who do everything possible to protect their police roles. We’re fortunate that the PSNI spreadsheet didn’t contain officer and staff home addresses, otherwise we would be facing a potentially calamitous situation.
“Inadequate or poor oversight of FOI procedures must be addressed and addressed urgently. New safeguards are obviously required to prevent this from ever happening again.”
Our Chair, Liam Kelly said this is a breach of monumental proportions and the officers we represent are appalled, shocked and angry. They want action to ensure this never happens again. @NIPolicingBoard @Justice_NI @PoliceServiceNI Read in full: https://t.co/uOmnvLneNM
— Police Federation for Northern Ireland (@PoliceFedforNI) August 8, 2023
The UK's Information Commissioner's Office said on Wednesday that it is investigating the matter.
People have the right to expect their personal information is kept safe. This incident shows how the smallest of human errors can have major consequences. We're working with the PSNI following their breach report.
Our statement 👉 https://t.co/vBVDUHFFoRhttps://t.co/AGPILfaABI
— ICO - Information Commissioner's Office (@ICOnews) August 9, 2023
Comments