Nobel House
Area 1E
17 Smith Square
T: 03459 33 55 77
London
xxxxxxxx@xxxxx.xxx.xx
SW1P 3JR
www.gov.uk/defra
Lee Murray
Our ref: FOI2021/13416
By email
: xxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxx.xxx
28 May 2021
Dear Lee Murray,
REQUEST FOR INFORMATION: Windows 7 and XP Thank you for your request for information of 19 May 2021 about Windows 7 and XP. We
have handled your request under the Freedom of Information Act 2000 (FOIA).
Your information request and our response are set out below.
1. How many instances of the Microsoft Windows 7 Operating System are currently in
operation across your entire network? How many devices such as kiosks, lap tops
etc are still running Windows 7?
2. How many instances of the Microsoft Windows XP Operating System are currently
in operation across your entire network ? How many devices such as kiosks, lap
tops etc are still running Windows XP?
The information you have requested falls under the exemption in section 31(3) of the
FOIA, which relates to the prevention or detection of crime. We have applied section 31(3)
which removes Defra’s duty in section 1(1)(a) of the FOIA to tell you whether we hold the
requested information. We can therefore neither confirm nor deny that Defra holds the
information falling within the description specified in your request. This statement should
not be taken as an indication that the information you requested is or is not held by the
Department.
In applying this exemption, we have had to balance the public interest in providing the
neither confirm nor deny response.
We recognise that there is a public interest in confirming whether information exists
concerning the software systems of a government department. We understand that
information on the use of Microsoft Excel within government would promote openness and
transparency.
However, there is a stronger public interest in neither confirming nor denying whether this
information exists as it could aid malicious parties in attempts to attack the IT systems
concerned. This is because some versions of Microsoft Excel are now out of Microsoft
support and there is a known security risk with IT machines that run these systems. Any
attempt to carry out a cyber-attack against an IT system is a criminal offence. This
exemption is engaged because either confirming or denying such information is held will
prejudice the prevention of crime by facilitating the possibility of a criminal offence being
carried out. Such confirmation can be used to aid or plan a cyber-attack and it would
potentially have detrimental impact to the running of public services.
3. Who is the officer responsible for maintaining and delivering legacy applications to
all your users?
After careful consideration we have decided that the [include as appropriate - names, roles
and contact details of junior staff and contact details of all staff] should be withheld under
sections 40(2) and 40(3A) of the FOIA as the information constitutes personal data relating
to persons other than you. These sections exempt personal information from disclosure if
that information relates to someone other than the applicant, and if disclosure of that
information would breach any of the data protection principles in Article 5(1) of the General
Data Protection Regulation (GDPR).
We consider that disclosure of this information is likely to breach the first data protection
principle, which provides that personal data must be processed lawfully, fairly, and in a
transparent manner. Disclosure would not constitute 'fair' processing of the personal data
because the junior staff involved would not reasonably expect their name to be disclosed
in relation to this request for information.
We attach an annex giving contact details should you be unhappy with the service you
have received.
If you have any queries about this letter please contact me.
Yours sincerely
D Lynch
Information Rights Team
xxxxxxxxxxxxxxxxxxx@xxxxx.xxx.xx
Annex
Complaints
If you are unhappy with the service you have received in relation to your request you may
make a complaint or appeal against our decision under section 17(7) of the FOIA or under
regulation 11 of the EIRs, as applicable, within 40 working days of the date of this letter.
Please write to Andrew Mobsby, Head of Information Rights via email at
xxxxxxxxxxxxxxxxxxx@xxxxx.xxx.xx and he will arrange for an internal review of your case.
Details of Defra’s complaints procedure are on our website.
If you are not content with the outcome of the internal review, section 50 of the FOIA and
regulation 18 of the EIRs gives you the right to apply directly to the Information
Commissioner’s Office (ICO) for a decision. Please note that generally the ICO cannot
make a decision unless you have first exhausted Defra’s own complaints procedure.
The ICO’s offices are currently closed so please visit their website on how to contact them
during this period, here:
https://ico.org.uk Additionally if you wish to make a complaint to the ICO please use the following link:
https://ico.org.uk/make-a-complaint/official-information-concerns-report/official-information-
concern/