Mr Matthew Law
By e-mail to: [FOI #22240 email]
Our Reference: 46944
3rd February 2010
Dear Mr Law,
I am writing with reference to your request for information regarding the NPIA IAM
Central Services Code of Connection , dated, 30th October 2009 made under section
1(1) of the Freedom of Information Act.
You asked for the following information:
I am looking for the following document from NPIA:
'NPIA IAM Central Services code of connection'
I can confirm that the NPIA does not hold the document named above; however we
do hold the IAM Code of Connection which may contain the information you require.
Some of the information in this document we consider to be exempt from the right
of access in accordance with sections 31(1) Law Enforcement, and Section 40(2) by
virtue of Section 40(3)(a)(i) of the Freedom of Information Act.
Application of Exemptions
Section 31 of the Freedom of Information Act is a qualified exemption and the
Public Interest Test is assessed below. This considers whether or not it would be
beneficial to the community at large to disclose the requested information.
Section 40 – (Personal Information)
This exemption is a class based, absolute exemption and there is no requirement to
establish the harm or the public interest. The NPIA believes that this exemption
applies as it contains personal details of individuals, who are not customer facing or
do not have a significant decision making role. Therefore, it would contravene the
first principle of the Data Protection act, namely – ‘Fair and lawfully processed’, if
these details were released, also none of the conditions in Schedule 2 are met.
National Policing Improvement Agency
Harm under Section 31 Law Enforcement
The disclosure of exempt information in this document would provide details of
system in use by the police force which would aid illegal intrusion into these sites.
Public Interest Test under Section 31 Law Enforcement
Consideration favouring disclosure:
The disclosure of the subject document would provide public confidence that the
NPIA has robust security procedures and that data transmission is secure at all
times.
Considerations favouring non-disclosure:
I have established that elements relating to the exact security environment are
considered sensitive and would be harmful if disclosed. The main reason for this is
that this information provides details that may lead to a denial of service attack on
a critical operational system and such denial of service would have a significant
impact on the ability for law enforcement agency to function.
There is evidence to suggest that disclosures of this type of information, has
weakened the security measures in place. As a result this would either be left
venerable to attack or appropriate counter measures put in place.
Balancing Test:
We need to maximum visibility of processes in the public sector; however this
should be balance with the need to protect sensitive information. This, of course,
can conflict with the need to protect sensitive data and, in particular, the processes
we use to protect such data.
We need to be careful about exposing documents which give details of our security
processes.
We also need to be careful of publishing seemingly innocuous information, as this
can result in a so called mosaic attack. This is where requests gather small amounts
of information from various organisations and putting it together makes up a much
more detailed and potentially risky picture.
We need also to remember that the data we are trying to protect is not our own
and we have a duty to look after force information.
- 2 -
© NPIA (National Policing Improvement Agency)
National Policing Improvement Agency
Decision:
We have decided to issue a redacted version in response to your request.
Your right to complain
We take our responsibilities under the Freedom of Information Act seriously but, if
you feel your request has not been properly handled or you are otherwise
dissatisfied with the outcome of your request, you have the right to complain. We
will investigate the matter and endeavour to reply within 3 – 6 weeks. You should
write to:
David Horne
Director of Resources
National Policing Improvement Agency
10-18 Victoria Street
London
SW1H 0NN
E-mail:
[email address]
If you are still dissatisfied following our internal review, you have the right, under
section 50 of the Act, to complain directly to the Information Commissioner. Before
considering your complaint, the Information Commissioner would normally expect
you to have exhausted the complaints procedures provided by the NPIA. The
Information Commissioner can be contacted at:
FOI Compliance Team (complaints)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Further information about the NPIA is routinely published on our website at
www.npia.police.uk or through our publication scheme. If you require any further
assistance in connection with this request please contact us at our address above.
Yours sincerely,
Andy Woodgate
IKS Advisor
National Policing Improvement Agency
- 3 -
© NPIA (National Policing Improvement Agency)
