Chris Heaton-Harris – 2023 Statement on the Security and Data Protection Breach in PSNI

The statement made by Chris Heaton-Harris, the Secretary of State for Northern Ireland, in the House of Commons on 4 September 2023.

I thank the right hon. Gentleman for his urgent question. As you know, Mr Speaker, I was keen to do a statement on the Police Service of Northern Ireland’s data breach on 8 August, so I am pleased to have this opportunity. I am also happy to provide an update to the House on this matter. However, since writing this answer, and as the right hon. Gentleman will know, news of the PSNI’s Chief Constable’s resignation has broken over the past few minutes. I thank Simon Byrne for his years of public service. The right hon. Gentleman will know that the appointment of a new Chief Constable is a matter for the Northern Ireland Policing Board, and I will continue to liaise with the senior management team of PSNI while the process of appointing a successor gets under way. The PSNI continues to have my and the Government’s full support in responding to the data breach, and we are focused on providing appropriate and proportionate data and expertise.

The breach, where the personal information of more than 10,000 officers and staff was accidentally published in what appears to be a human error involving a number of spreadsheet fields, happened on 8 August. Not realising that the relevant document contained a hidden table, the initials and surnames of every rank and grade, the location where an individual was based—but not their home address—and their duty type were published online for approximately three hours. The data breach is deeply concerning and significant. Recent events in Northern Ireland, including the terrible attack on Detective Chief Inspector John Caldwell, show that there is still a small minority in Northern Ireland who wish to cause harm to PSNI officers and staff in Northern Ireland. I take this opportunity to thank all those individuals who work to keep the people of Northern Ireland safe. They have my many thanks, and we all owe them our gratitude.

I recognise, too, that there is significant concern about the consequences of this data breach. Many PSNI officers and staff have raised concerns about themselves and their families, and they have my support and understanding as they go about their important work, keeping communities safe in these worrying and most testing of circumstances. To them, I again say thank you.

In response to these concerns, the PSNI and wider security partners are taking appropriate action and are working around the clock to investigate the incident, provide reassurance and mitigate any risk to the safety and security of officers and staff. As of 30 August, 3,954 self-referrals have been made to the PSNI’s emergency threat management group. That is part of the welfare and support services that have been made available to PSNI officers.

The House will understand that the PSNI is devolved and has operational independence. That has been the case since April 2010 with the creation of the Department of Justice. However, as the House would expect, the Government have remained in close contact with the PSNI since this breach and other data breaches came to light. My officials and I have been receiving regular updates and the Government’s focus has been on providing specialist support and expertise to the PSNI in its handling of this issue. Officials in the Cabinet Office have chaired—[Interruption.] I will finish in a second, Mr Speaker. Officials in the Cabinet Office have chaired regular meetings, and I will update the House further, hopefully during this urgent question.

Sir Jeffrey M. Donaldson

Thank you, Mr Speaker, for the opportunity to raise the plight of police officers and staff in Northern Ireland. The industrial-scale breach in data last month was yet another self-inflicted blow to the morale of the police service, as well as to confidence in policing across Northern Ireland. For the rank and file, and for the staff working in our police stations, for their personal details to be released into the public domain and to find their way into the hands of dissident republicans is unforgivable.

The current terrorist threat level in Northern Ireland is “severe.” Just a few months ago, Detective Chief Inspector John Caldwell was barbarically attacked by gunmen in front of his young son after coaching an under-15s football team near Omagh. Now, each one of his colleagues must come to terms with the fact that they and their families have potentially been placed in harm’s way by the release of this data.

It goes further than that. Last week’s ruling by Mr Justice Scoffield found that the PSNI’s senior command unlawfully disciplined two of its own officers in order to appease Sinn Féin. These actions are hugely damaging to community relations, to community confidence and to confidence in the rule of law in Northern Ireland. Fair and even-handed policing is just as foundational to progress in Northern Ireland as is fully functioning political institutions operating on a cross-community consensus basis. We therefore need to hear from the Government that they will ensure that the necessary resources are available to the police—notwithstanding budgetary constraints—so that police officers, their families and police staff are properly protected against terrorist attack.

Furthermore, the Democratic Unionist party welcomes the decision by the chief constable to announce his resignation. We believe that is the right thing to do in all the circumstances. Now we want to see confidence rebuilt in our police service, and we will work with the PSNI—it has our full support—to achieve and deliver effective and efficient policing for everyone in Northern Ireland in a way that commands cross-community support.

Chris Heaton-Harris

I thank the right hon. Gentleman again for the urgent question and for the various questions he has posed. Officials in the Cabinet Office have chaired regular operational meetings—initially daily—bringing together the PSNI, Government Departments and our world-class security services to ensure that all their collective skills, including cyber-expertise, have been brought to bear in supporting the PSNI on the breach.

You will appreciate, Mr Speaker, that given your ruling on sub judice and for security reasons, I cannot comment on specific details of the response, but six individuals have been arrested by detectives investigating the breach and the criminality connected to it. Five have been released on bail to allow for further police inquiries and one has been charged with possessing documents or records likely to be useful to terrorists, and another item.

The right hon. Gentleman mentioned money. The response to such a significant breach will obviously come with a cost. The UK Government are clear that security is paramount, and the focus remains on support and expertise at this point. With Northern Ireland’s policing being devolved, it is for the Department of Justice to set its budget and ensure it can fulfil its duties and responsibilities, but it still remains a fundamental responsibility of the Executive—in their absence, Northern Ireland Departments—to run a balanced and sustainable budget. Where additional funding is required, the correct process, which includes a whole host of different things, must be followed. However, I completely understand the right hon. Gentleman’s point.

Theresa Villiers (Chipping Barnet) (Con)

This whole episode is agonising. I want to put on record my support and sympathy for all those brave men and women of the PSNI who fear for their security and that of their families as a result. I urge the Secretary of State to do everything possible with the PSNI to ensure that documents of this sensitivity are subject to sufficient protection so that a mistake of this sort can never ever be made again.

Chris Heaton-Harris

I think that the right hon. Member for Lagan Valley (Sir Jeffrey M. Donaldson) referred to it in his question as a “self-inflicted” wound, and it surely was. To be frank, checks and balances should have been in place. I completely agree with my right hon. Friend, and we will do what we can to assist the PSNI and the Department of Justice, as she would expect. We keep abreast of these matters, as I hope I detailed in my answers, but this is a really significant breach. As one police officer put it to me, “When I joined the police service, I used to think when I went to work that maybe people knew what I did for a living, but now that has completely flipped—I feel that they absolutely know what I do for a living.” That has changed the psychology around the whole piece. I know that a lot more assurances need to be given for us to get to the place that my right hon. Friend wishes to get to.