LAST UPDATE | 5 Sep 2023
A MAJOR PSNI data breach could potentially cost the force £240 million (€281 million) in security and legal costs, MPs have been told.
Assistant chief constable Chris Todd also told the Northern Ireland Affairs Committee that almost 4,000 officers and staff have come forward with concerns after their personal information was released online.
The committee is investigating the data breach in which details of around 9,500 PSNI officers and staff were mistakenly published last month in response to a freedom of information request.
The PSNI has confirmed the list, which included the surname and first initial of every employee, their rank of grade, where they are based and the unit they work in, is in the hands of dissident republicans.
Committee chair Simon Hoare asked Todd if the PSNI had done an assessment of the cost of mitigating against the impact of the data leak.
Todd said recovery costs around security measures were estimated at £24 million (€28 million) to £37 million (€43 million).
He confirmed this did not include the cost of potential compensation claims.
He said: “In terms of individual litigation we naturally will plan for that eventuality.
“I would estimate that could be in the region of £150-180 million (€175-210 million).”
Hoare said: “We are talking in ballpark terms of an unexpected expenditure of about £230-240 million (€269-281 million).
“Existing budgets could not sustain that?”
Todd said: “No. We already have a funding gap of around £50 million (€58 million).”
MP Robert Buckland asked how many people had viewed the information on the freedom of information request within the PSNI before it was released publicly.
Todd said: “In a query of that nature four or five people.
“It has gone through a number of eyes, the mistake has not been rectified or identified which suggest that we have systems errors we need to address.”
Hoare said: “It does beggar belief that everybody made the same mistake. The odds of four people not spotting such a glaring error would be very considerable.”
Todd responded: “It was not glaring to the naked eye and that is part of the issue. The fact that the core dataset remained attached was not obvious to the naked eye.”
The committee chair said the breach “smacked of incompetence”.
Todd said: “If an individual misses something you might immediately go to that conclusion, when two people miss it you may start to question that, in this case where four (people missed it), I think we need to look beyond incompetence on an individual human basis and look at the competence of the system and process which allowed that to happen.”
The senior officer said that by the weekend 3,954 members of the organisation had come forward to register concerns about their personal information being shared.
He said the information was viewed approximately 300 times online before it was taken down.
Hoare said: “You have sought to assure us you are absolutely confident this was effectively human error and you have no concerns at all that this wasn’t a deliberate breach of data.
“I am finding it hard as a layman to understand why four people didn’t spot it over a period of time but the recipient within two and a half hours does.
“I am not writing the plotline of Line Of Duty but it just strikes me as stretching credulity a little too far.”
Todd said he had no concerns that the leak was done deliberately.
He added: “There is an ongoing investigation into how the leak happened. The initial assessment was very clear there was no mal-intent in any of the individuals involved in this breach.”
Former Chief Constable Simon Byrne had been expected to appear as a witness before the committee before he resigned from his position yesterday.
Earlier today, Hoare also described the job of PSNI Chief Constable as the “most difficult gig”.
The Northern Ireland Policing Board withdrew from the hearing following Byrne’s resignation.
A public session of the board scheduled for Thursday has also been cancelled.
SDLP MP Claire Hanna told the committee: “Could I put on record my concerns that the Policing Board aren’t here.
“I appreciate it is a choppy time, there is a lot going on, but my understanding is there hasn’t been a meeting in public since the data breach.
“The one that was scheduled for later this week isn’t occurring.
“I think it would have been useful and appropriate to have the Policing Board here as part of this session and as part of our scrutiny and as a part of people feeling that these issues are being properly scrutinised.”
Hoare responded: “We will hear from them. Whether we have to use our right to summon witnesses, which we can, or whether they can find a time voluntarily to appear before us.
“But the board should be in no doubt at all that they will appear before this committee to take our questions and will do so in public.
I was as disappointed as everybody that they felt unable to come today.
“I suppose the germane fact is the chief constable resigning yesterday obviously played a part, but we will hear from them.”
He added: “I wanted to put on record that anybody who steps up to the plate to be chief constable of the PSNI, it is probably the most difficult gig in policing.
“Anybody who does it deserves the recognition and thanks of this committee and the people of Northern Ireland for being prepared to step up and to try to police and to shape a modern police service to fit the current circumstances.”
To embed this post, copy the code below on your site
have your say