Dear Norfolk and Waveney Sustainability and Transformation Partnership,

This is a request for information under the Freedom of Information Act.

Please provide the following details of any and all gifts and/or hospitality provided by the cybersecurity company Darktrace (also known as Darktrace Limited, Darktrace Holdings and Darktrace Plc):

-- The monetary value;
-- The description;
-- The date;
-- The unit, office or department in which the recipients of the gifts/hospitality worked;
-- Whether the gifts/hospitality were accepted, rejected, or otherwise donated;

Please provide this information for any gifts/hospitality received from June 2013 onwards inclusive in the form of an itemised list for each instance of a gift and/or hospitality.

Please also disclose whether you were using Darktrace's services in May 2017.

Please provide the most up-to-date information as of the date this request is fulfilled in electronic (soft copy) form.

If it is not possible to fulfil this request due to the information exceeding the cost of compliance limits identified in Section 12, please provide advice and assistance, under the Section 16 obligations of the Act, as to how I can refine my request. If you can identify any other ways that my request could be refined I would be grateful for any further advice and assistance.

Thank you for your assistance and I look forward to your response.

Kadhim Shubber

Hi Chris,

Thank you for getting back to me.

I'll reach out to the partner organisations directly as you suggest. Would you be able to provide a response for the CCG itself (and its predecessor CCG organisations)?

Kadhim

Cheers, appreciate the help!

Kadhim

Hi there,

I'd like to request an internal review.

The Trust declined to confirm whether or not it held information about whether it was using Darktrace in May 2017, nor to provide that information if it is held. The basis of that refusal appears to be that there would be some risk to the Trust's cybersecurity if such disclosures were made. The Trust cites the exemption under Section31, which requires the Trust to show that there would be a "causal" link between the disclosures and the alleged harms.

The Trust in its refusal has attempted to show such a link, but I do not believe it has been successful.

The Trust asserts that: "To confirm or deny if the CCG was or was not using the services of Darktrace in May 2017 would make the CCG more vulnerable to crime as it would reveal which cyber security systems and services the CCG has used and is using."

While the requested information would reveal the cyber security services has used, it would not reveal what services it is using today. My request sought only the basic fact of whether the Trust used a particular supplier some four years ago, long in the past. This is of no use to a potential hacker today. Even the most skilled hackers cannot go back in time to attack the Trust, and information about a state of affairs years in the past does not reveal anything about the current status of the Trust's cybersecurity systems. The Trust notes that May 2017 was the month the WannaCry attack hit the NHS -- I don't think anybody thinks that NHS cybersecurity defenses did not change following that incident.

For these reasons, I do not believe that the Trust can make the required showing of a casual link to harm under the cited exemption.

Thank you for considering this matter.

Kadhim