FI16190

Request

I would request you to respond to questions included in the attachment.

Response

The information you have sought is attached. 

We do not release information about IT security systems. This is because we consider disclosing this information would make the Council a target of crime. Therefore, this information is exempt from disclosure under section 31 of the Freedom of Information Act 2000.  Section 31(1)(a) says that we do not need to provide information that would be likely to prejudice the functions of law enforcement - the prevention and detection of crime. 

The Council believes that releasing this information would increase the likelihood of: 

  • criminals using the information to target attacks against Council systems. For example, knowing when we last updated a security system would allow criminals to know what vulnerabilities existed at that time and target attacks on those. It is important the Council does not do anything that would allow personal data it holds to be accessed illegally.
  • knowing if the Council’s systems do not have particular vulnerabilities will increase the chances of other more vulnerable organisations being targeted by criminals 

Public Interest Test 

As Section 31 is a qualified exemption we need to consider the public interest test. 

Factors in favour of disclosure: 

  • It would help transparency and accountability of the council
  • It would reassure people about whether our systems are vulnerable or not
  • It would provide information about how effective our security systems are 

Factors in favour of withholding: 

  • There is an inherent public interest in crime prevention.
  • There is public interest in avoiding the costs (financial, distress, inconvenience, publicity, regulatory) associated with any attacks
  • There is public interests in preventing any threat to the integrity of council data
  • There is public interest in ensuring the council can comply with its duties to take all necessary steps to safeguard data 

We believe that the balance of public interest lies in upholding the exemption and not releasing the information

Attachments

Attachment