PFNI Chairman, Northern Ireland Affairs Committee Evidence

PSNI data breaches - Oral Evidence from 12 December 2023

‘We are now managing the consequences of the data breach, not only this year but for years to come’ – Liam Kelly

The Chair of the PFNI, Liam Kelly, took part in a second evidence session before members of the Northern Ireland Affairs Committee at Westminster.

His appearance followed publication of a detailed report on the data breach by the National Police Chiefs’ Council.

Mr Kelly, in wide-ranging evidence to MPs,  dealt with the contents of the report and suggested remedies; the damage that was done; risks posed to officer safety; the need for adequate funding and resources; officer confidence; the continuing reduction in Service strength and the steps that have to be taken.

What follows are some of the key points Mr Kelly delivered.

On the report into the data breach, Mr Kelly offered: “The term that was used yesterday by the Chief Constable was “sobering”. I echo those sentiments, because it shone a light on a process whereby the PSNI has been traditionally very good at dealing with external threats, but not so good in dealing with internal threats in relation to data security. The report in totality, with the 37 recommendations, would suggest to me that there is a large body of work required to enable the PSNI to put the trust and confidence back into our officers, who have been so badly let down as a result of this data breach.

“…..As I explained the last time I appeared before you (September), there is a spectrum of impact. The report picks up on that. You have ambivalence from some people, right through to palpable fear. As part of the Information Commissioner’s Office investigation and evidence gathering, we have provided some anonymised personal testimonies. It really does give a snapshot of the impact that that is having on not only the officers, but their families.

“…..Officers appear less concerned about themselves but more about their families in relation to this. Their initial assessment of Op Sanukite and the PSNI’s initial reaction to this is that the tangible, practical support was negligible, and still is to this point.

£500 payment

“Only yesterday did we get some detail around the universal offer. The first we were notified around the universal offer formally was last Friday, when temporary Deputy Chief Constable Todd put an email around the Police Service. The details of that are still to be finalised. In fact, the Chief Constable has indicated a payment of perhaps up to £500 towards some of the security measures that Superintendent (Gerry) Murray has mentioned.

“Unfortunately, we live in a world where things are relatively expensive. In fact, some of those personal testimonies are saying that officers could not afford to actually start to do things like that. They were taking some pretty drastic decisions around trying to protect both themselves and their families.

“There is also the hidden aspect of the impact. What we have seen is a massive increase in people presenting themselves to occupational health to ask for help and support. Unfortunately, our occupational health within the organisation has been underfunded and under-resourced for a long period of time. Just to give you a snapshot of the waiting times, there is an eight-month waiting list in the PSNI to see a psychologist. You can imagine the personal impact on someone who is struggling with their mental health if they cannot see and talk to someone for maybe eight months.

“…..We have also seen an exponential rise in the number of officers who are citing the data breach as the final straw for them in relation to either staying in service or applying for ill health retirement.

“This year, we have 199 people asking for ill health retirement. That is a 100% increase on normal. Again, the data breach is being cited as the straw that broke the camel’s back, really, for people. They feel let down by the organisation, unsupported by the organisation, and cannot see a pathway of coming back to the organisation. That is extremely frustrating.

Strong resolve

“Just to reaffirm the point that the chief made yesterday, we have seen a strong resolve from the vast majority of officers to get about, continue to serve the public and do their job, which is fantastic to see. However, at the other end of that spectrum we have a lot of people who are seriously struggling over what has happened.

“As Chief Superintendent (Anthony) McNally (SANI) has highlighted, there needs to be some significant financial investment here to enable the PSNI to deal with this effectively. That is not just the outworkings of the costs that are going to be associated with building up the processes, procedures, hardware and software required to protect data; that investment is going to be required to assist the officers to manage this. At 2.6, the report says this cannot be undone, and that is true.

“I mentioned last time that the genie is out of the bottle. We are now managing the consequences of this, not only this year but for years to come. That is going to take time and money.

“The concession made yesterday around the individual support for the universal offer, by my sums, equates to about £5 million. I do not know whether that was factored into the PSNI’s budget case made to Treasury in September, which Mr Todd had referred to as costing between £24 million and £37 million just to stand still.

No Treasury response

“As far as I am aware, there has still been no response to Treasury in relation to that matter, which at this point, four months on, is pretty disappointing from our members’ perspective.

“Just to sum up in relation to the impact, what we are seeing is that our officers are committed to doing the best they can, but people are struggling and looking for help, and unfortunately that help is really either negligible or so far down the line that they are now looking at alternatives.

Heading to Australia

“One stat that the Chief Constable did not mention yesterday, but he has mentioned before, is that 50 of our officers have applied to go to Australia. That is just extraordinary. In years gone by, you could count on one hand the number of people who would do that. We now have 50 officers who have put themselves forward to say, “We no longer think we can serve in Northern Ireland, but we want to remain within policing,” and Australia is the option for them. That is extraordinary.

“…..The problem is that we do not have any recruitment. The recruitment stopped in April of this year. The Chief Constable has indicated that, as a result of the deficit budget and his inability to keep people safe, he may have to set aside his accounting officer responsibilities and actually just say, “I need to bring people in,” because the number of people leaving is resulting in the organisation shrinking to unimaginable levels.

“As Detective Chief Superintendent McNally has mentioned, the projection by March next year ordinarily just on retirements would bring the organisation down to 6,358, but if you factor in 50 people potentially going to Australia and 199 people potentially on ill health retirement that number is getting closer to 6,000.

“…..On a day-to-day basis, the PSNI has around 500 officers and staff off on sickness absence. The number of people who are front facing in the organisation is diminishing by the day, with no new people coming through. This is one of the important things about confidence in introducing the measures in the recommendations.

‘Going to take time’

“Someone looking in wants to be confident that the PSNI will protect their identity, protect their data and have their back in relation to these matters. It is going to take time to do that. The report is the first step of that process, but it is certainly not the last step. It now needs to be implemented, and it needs significant investment to do that.

“…..In relation to the event, as it is termed in the report, it has reinforced what we understood to have happened. It reinforces the recommendations in the report about siloed working. A lot of people in the organisation do not fully understand how this could have been missed in the circumstances, as has been laid out.

“One of the things that the report picks up on is about assumed knowledge in relation to reports. I completely concur with that. Much as a lot of people in the organisation would use certain Microsoft software products such as Outlook, Excel or any of the others, they have never been trained on them. This is something that you pick up as you go along or when someone shows you.

“The report mentioned the three dots approach. That was the first time I had ever seen that. When I went through some of the spreadsheets that we keep in our offices, which are outside the PSNI systems, I noticed that button for the first time. If you were not looking for it and you were not trained to see it, you probably would not have seen it. Again, it is a wee bit disappointing that we have people working in that area, who are deemed to be professionals in it, but who have never picked up on that or seen it before.

‘A silo environment’

“…..There has been a human resources review that has been going on for some time. One of the recommendations from that—it is the same for occupational health—was about how the internal systems did not talk to each other. They were operated in a silo environment. SAP is antiquated and requires a major update.

“For me, the learning coming out of this is that people who move into the HR world are taught some of this stuff by their peers rather than having bespoke training. Bespoke training is one thing that has been mentioned around this. The overall thing around the freedom of information process is that there was not one single standard operating procedure being used.

Proper Training

“A person’s own experience or their line manager’s experience would dictate how that process worked. There does not seem to have been any corporate knowledge around that. When people moved on or were not there, the next person did not pick up on that. This has shone a light on a number of failings. Again, of the most important recommendations is to have proper training put in place and a standard operating procedure in play specifically in relation to FoI matters.

“…..Just to pick up on what is in the report, the report’s author comments on the extraordinarily high number of internal (FoI) applications. They are about 20% of the overall number, which is extraordinary. In his experience of data and police services handling data across the UK, that figure was the highest he had ever seen. There is an element of distrust within the organisation, which I would say stems from a lack of confidence in the processes and how things are done.

“This is an opportunity for the PSNI to try to level the field in that regard and to be more transparent. The two principal issues relate to promotion and temporary promotion, and how those processes happen. That was the genesis of this data breach. It was a request that came in around how many temporary promotions were in service and where that is.

‘Lot of distrust’

“It is an opportunity for the PSNI to address its workforce and say, “We need to be more open and transparent around some of these processes and how they work.” That would assist in lowering the actual number of applications that are made. Unfortunately, that is another bit of work in progress. There is a lot of distrust in the organisation and a perception of organisational unfairness around things. This is one of the outworkings of the reducing budget and the organisation being unable to promote people substantively. It is filling gaps with temporary promotions outside of having promotion processes. Those processes are dealt with in different areas by different people in different ways. That causes confusion and resentment.

“If they do not get the answers they want, this is the only mechanism they have.

“They have tried to standardise the processes, but, again, particularly when you are moving into specialist departments and things, you cannot put a square peg in a round hole. Not everybody is suitable for a particular role. When they put in “desirable” or “essential experience”, sometimes the perception of others can be that a job has been allocated to or designed around one person and one person only, which causes that narcissistic approach for people when they are there.

Open and transparent

“There certainly are things that they can do to be more open and transparent around that. The biggest departments in the police are district policing commands, which cover the three areas of frontline policing, crime ops and ops support. You could easily do that in district policing command and have some consistency across the three areas. Unfortunately, at times the demand in particular areas causes the organisation to have to step outside its processes, because it cannot get people to put themselves forward for particular posts—perhaps they do not want to pigeonhole, or constrain themselves if a substantive promotion comes in and they are told, “You are doing the job temporarily. Therefore, you can stay.”

“Maybe they do not want to stay. They might just be doing it for financial reasons at that time; they might actually want to work somewhere else in the organisation, but they find themselves stuck in a particular area. At times, there is a reticence for people to step forward. As I say, the bigger issue is people thinking that they are being pigeonholed or overlooked for a post because of processes that are not as transparent as they could be

“…..I have a few observations to make on the cultural skills and talent recommendations. You could apply this to any specialism within the PSNI. For example, with Mr McNally in public protection and Mr Murray in ops support, we invest considerable sums of money in training people, but we do not invest considerable sums of money in retaining them in those positions.

“If those officers are interested in promotion or lateral development, the ability for them to do that within those particular areas diminishes. It is something I see time and time again. I will give you an example from district policing. If there is a neighbourhood officer who wants to go for promotion but there is no vacancy for a supervisor in the area they have been working in for the last 10 years, that skillset is lost. In fact, they do not even go into neighbourhood policing. They go in back into local response policing and things like that.

Skillset lost

That skillset is completely lost. At some point in the future, someone else has to come in and start again from the bottom up. Yes, it is very important that we have the pathways available for people, but, as I see it, every specialism in the PSNI needs to focus on this.

“When I first joined the police—it was not as long ago as Mr Murray—almost 30 years ago, there was talk about tenure being implemented following the Sheehy report. The staff associations were for and against it in some regards,. We were saying that it is difficult for people to progress in the organisation if a pathway is closed because someone is in a role forever. There was talk about five years. Ultimately, those things were never implemented because it was impossible to do that in service.

Natural attrition

“The natural attrition of retirement and promotion has been used to create vacancies. I am picking up on Warren’s point about the lack of resource in that particular area. Again, you could highlight that in almost any part of the PSNI now. We have no recruitment at the moment, so it is impossible to replace anybody who is in any of those specialist roles because the people are not there to do it.

“The Chief Constable has already put on record that he wants to protect the frontline 999 response. Unfortunately, that is the student officers and probation officers at the moment, which we do not have. That is where the main squeeze is. Yes, I commend the report, but there is a bigger question for the PSNI overall, if it is going to try and bring that in right across the board as opposed to just in information management.

“…..One of the main outworkings of the report is about restoring public and internal conference in policing. I have no doubt that the data breach has had a massive detrimental impact on future recruitment. I have no doubt about that whatsoever.

“This report is an opportunity for the PSNI to demonstrate its desire to improve around this and to demonstrate that, as I mentioned at the outset, it has officers’ backs and will protect and support them as best possible.

Confidence in intelligence

“One of the other unintended consequences of this was the impact on officers’ confidence in the intelligence system. That was shaken originally this year by the abhorrent attack on Detective Chief Inspector John Caldwell. That really detailed pre-planned operation was not picked up in any way by any of our internal or external intelligence services.

`’While the PSNI has an emergency threat assessment group, there is a perception among individual officers in service that the organisation’s intelligence assessment is not a reality. They have raised legitimate concerns using that traffic light system—we mentioned the red, amber and green scenarios—and the organisation has graded them as green.

“These officers are saying, “As a result of this, I am more hypervigilant about things. I have paranoia around this. I want to be able to go to my social club. I want to take my children to their clubs. I want to do X, Y and Z. You are telling me that everything is okay, but you got it so wrong in John Caldwell’s case, maybe you have got it wrong in my case as well. I am not willing to take that risk.”

“That is why we see people going to extraordinary lengths. It is alluded to in the report. One person moved house. They are not confident in the intelligence assessment that the PSNI is giving them or that it is going to protect them in the long term.

“As I have said, the genie is out of the bottle. This will have consequences and ramifications for years to come, so it is important that this report and its recommendations are implemented. The big question around that is, “Where are the finances coming from to do this?” It is going to take a significant investment. It is not something the PSNI can absorb within its existing internal budget, which at the moment is sitting with a deceit of £52 million.”

The full transcript of the NIAC session can be accessed here:

https://committees.parliament.uk/event/19892/formal-meeting-oral-evidence-session/