Our Ref: 9311  

Dear Enquirer,

INFORMATION REQUEST

Thank you for your request for information which will be dealt with under
the terms of the Freedom of Information Act 2000.

In some circumstances a fee may be payable and if that is the case, we
will let you know the likely charges before proceeding.

If you have any queries about this matter please contact us. Please
remember to quote the reference number above in any future communications.

Please note, that due to the recent outbreak of Covid-19, there may be a
delay in responding to your request. We appreciate your patience at this
busy period.

Kind regards

Information Governance Office
Northumberland County Council
County Hall
Morpeth
Northumberland
NE61 2EF

Tel: 0345 600 6400
Email: [Northumberland County Council request email]
Web: http://www.northumberland.gov.uk

Our Ref: 9311   

Dear Enquirer,

FREEDOM OF INFORMATION ACT REQUEST

I refer to your Freedom of Information request for details of operating
systems and legacy applications.

Right of Access
Section 1(1) of the Act provides any person making a request for
information to a public authority is entitled.
(a) to be informed in writing by the public authority whether it holds
information of the description specified in the request (which Section
1(6) of the Act designates as the "duty to confirm or deny"), and
(b) if that is the case, to have that information communicated to him.

The right is to obtain access to the information itself and not to the
document or record which contains it. The Act creates a general right of
access to information held by public authorities subject to various
exemptions.
Duty to confirm or deny
We hold the information you requested. However, we are withholding some of
the information in relation to your request since we consider that the
exemption under Section 31(1)(a) applies.
Response
Q.1 How many instances of the Microsoft Windows 7 Operating System are
currently in operation across your entire network? How many devices such
as kiosks, lap tops etc are still running Windows 7? Exempt under Section
31(1)(a).
Q.2 How many instances of the Microsoft Windows XP Operating System are
currently in operation across your entire network ? How many devices such
as kiosks, lap tops etc are still running Windows XP? Exempt under Section
31(1)(a).
Q.3 Who is the officer responsible for maintaining and delivering legacy
applications to all your users?  We have an Application support team that
are responsible for installing and supporting software applications.
Exemptions
The Freedom of Information Act sets out various exemptions to the right of
access. In the present case the County Council takes the view that the
information relating to question 1 and 2 of your request is exempt under
31(1)(a). The full wording is provided below: 

"31 Law enforcement.
(1) Information which is not exempt information by virtue of section 30 is
exempt information if its disclosure under this Act would, or would be
likely to, prejudice—
(a) the prevention or detection of crime,
(b) the apprehension or prosecution of offenders,
(c) the administration of justice,
(d) the assessment or collection of any tax or duty or of any imposition
of a similar nature,
(e) the operation of the immigration controls,
(f) the maintenance of security and good order in prisons or in other
institutions where persons are lawfully detained,
(g) the exercise by any public authority of its functions for any of the
purposes specified in subsection (2),
(h) any civil proceedings which are brought by or on behalf of a public
authority and arise out of an investigation conducted, for any of the
purposes specified
in subsection (2), by or on behalf of the authority by virtue of Her
Majesty’s prerogative or by virtue of powers conferred by or under an
enactment, or
(i) any inquiry held under the Fatal Accidents and Sudden Deaths Inquiries
(Scotland) Act 1976 to the extent that the inquiry arises out of an
investigation conducted, for any of the purposes specified in subsection
(2), by or on behalf of the authority by virtue of Her Majesty’s
prerogative or by virtue of powers conferred by or under an enactment.

(2) The purposes referred to in subsection (1)(g) to (i) are—
(a) the purpose of ascertaining whether any person has failed to comply
with the law,
(b) the purpose of ascertaining whether any person is responsible for any
conduct which is improper,
(c) the purpose of ascertaining whether circumstances which would justify
regulatory action in pursuance of any enactment exist or may arise,
(d) the purpose of ascertaining a person’s fitness or competence in
relation to the management of bodies corporate or in relation to any
profession or other activity which he is, or seeks to become, authorised
to carry on,
(e) the purpose of ascertaining the cause of an accident,
(f) the purpose of protecting charities against misconduct or
mismanagement (whether by trustees or other persons) in their
administration,
(g) the purpose of protecting the property of charities from loss or
misapplication,
(h) the purpose of recovering the property of charities,
(i) the purpose of securing the health, safety and welfare of persons at
work, and
(j) the purpose of protecting persons other than persons at work against
risk to health or safety arising out of or in connection with the actions
of persons at work.

(3) The duty to confirm or deny does not arise if, or to the extent that,
compliance with section 1(1)(a) would, or would be likely to, prejudice
any of the matters mentioned in subsection (1)."

Public interest considerations
The public interest in favour of disclosing the information is that it
allows for transparency and scrutiny over the management of our systems
security, ensuring it is adequate and provides sufficiently robust
protection for the information held by the Council. This in turn may also
increase public confidence. However, releasing the information would pose
a real and significant risk that it could be used by malicious actors to
conduct the first stages of a cyber-attack by gather information
(reconnaissance), searching for potential vulnerabilities of these
operating systems and exploiting them. Providing such information is
assisting the actors to act upon these vulnerabilities and compromise our
system security.  We therefore consider that the public interest in
maintaining the exemption outweighs the public interest in disclosing the
information in relation to question 1 and 2 of your request.
Notice of Refusal
Please treat this letter as a Notice of Refusal as regards the information
covered by the Section 31 exemption.

Advice and Assistance
The County Council recognises its statutory duty to provide advice and
assistance under Section 16 of the Act. Subject to the provisions of the
Freedom of Information Act, the Council is seeking to be transparent and
open in its response.

Complaints
If you are unhappy with the way your request for information has been
handled, you can request an internal review by writing within 2 months
from the date of this response to the Information Governance Office:

Information Governance Office
Northumberland County Council
County Hall
Morpeth
NE61 2EF

Email: [Northumberland County Council request email]

Information Commissioner

If you remain dissatisfied with the handling of your request or complaint,
you have a right by Section 50 of the Act to apply to the Information
Commissioner for a decision as to whether your request has been dealt with
in accordance with the requirements of the Act at:

The Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113
Email: [email address]

There is no charge for making an appeal

Yours faithfully

FOI Coordinator -
Information Governance Office
Northumberland County Council
County Hall
Morpeth
Northumberland
NE61 2EF

Tel: 0345 600 6400
Email: [Northumberland County Council request email]
Web: http://www.northumberland.gov.uk