Northern Ireland Affairs Committee
Oral evidence: PSNI data breaches, HC 47
Tuesday 12 December 2023
Ordered by the House of Commons to be published on 12 December 2023.
Members present: Sir Robert Buckland (Chair); Sir Robert Goodwill; Claire Hanna; Jim Shannon.
Questions 277 - 298
Witnesses
I: Liam Kelly, Chair, Police Federation for Northern Ireland; Detective Chief Superintendent Anthony McNally, President, Police Superintendents’ Association of Northern Ireland (SANI); Superintendent Gerry Murray, Chairperson, Catholic Police Guild of Northern Ireland; Warren Scott, Departmental Assistant Secretary for Northern Ireland Public Service Alliance, Police Service of Northern Ireland.
Written evidence from witnesses:
– [DBN0001] Police Federation for Northern Ireland
Examination of witnesses
Witnesses: Liam Kelly, Anthony McNally, Gerry Murray and Warren Scott.
Q277 Chair: Good morning. This is a meeting of the Northern Ireland Affairs Select Committee. Our session is about the findings of the independent review into the data breach of the PSNI. We are very pleased to be joined this morning by Liam Kelly, the chair of the Police Federation for Northern Ireland; Detective Chief Superintendent Anthony McNally, the president of the Police Superintendents’ Association of Northern Ireland; Superintendent Gerry Murray, the chair of the Catholic Police Guild of Northern Ireland; and Warren Scott, the PSNI departmental assistant secretary for the Northern Ireland Public Service Alliance. Welcome.
I will start by asking each of you to give the Committee, in outline, your initial reaction to the findings of the independent review.
Liam Kelly: Good morning. The term that was used yesterday by the Chief Constable was “sobering”. I echo those sentiments, because it shone a light on a process whereby the PSNI has been traditionally very good at dealing with external threats, but not so good in dealing with internal threats in relation to data security. The report in totality, with the 37 recommendations, would suggest to me that there is a large body of work required to enable the PSNI to put the trust and confidence back into our officers, who have been so badly let down as a result of this data breach.
Anthony McNally: I echo the sentiments of the Chief Constable yesterday and my colleague Mr Kelly here this morning. The organisation gave us sight of the report a number of days ago. We welcome sight of that. I also very much welcome the words within the report that it is not the result of an incident involving one person, but of the PSNI as an organisation not seizing opportunities to better and more proactively seize its data.
I want to touch on that in a number of ways, firstly in regard to my staff colleagues who were involved in this incident and our ongoing support for them in terms of the challenging environment that they operated in, as reflected in that statement. A key word in that statement for me is “proactive”. I understand that, and it is important, but we cannot be fully proactive without having the right capacity. We know as an organisation, through many reports, that we should have over 7,000 officers, but by the end of March 2024 we will have 6,358, if not fewer. If the current environment continues, that will reduce to fewer than 6,000 into 2024.
It is really difficult for us to be proactive. The report even referenced moving from being defensive to being more on the attack, if you want, or more attack-minded. As a football fan, you will know that if a team goes down to 10 men, they tend to sit back and be defensive and to hold on to what they have. That is part of the concern here around us being proactive.
I understand it and I welcome the 37 recommendations, but I want to make it really clear that, as an organisation, we need investment to be able to deliver those 37 recommendations, and not just that, but to give our officers the pay raise that they rightfully deserve. The conservative estimate is at least £100 million of an uplift in budget, and that is outside the money for Operation Sanukite. We welcome the report, the 37 recommendations and the five thematic areas, but they will not be delivered effectively without further funding.
Gerry Murray: Good morning. I totally concur with what my colleagues have said. The Catholic Police Guild are fully supportive of the independent review team, the 67 pages within the document Protecting from Within, and the 37 recommendations. This will take finance, it will take resources and it will be continuous.
The theme throughout this report is that it is not just for one individual department within the Police Service of Northern Ireland to make sure that we are secure within, but it is for every individual, from the recruit coming into the organisation to the officer who is exiting the organisation, including staff.
I have only had a chance to look at the executive summary, but 20% of freedom of information questions coming internally within the organisation on two topics, promotion and temporary posting, should sound alarm bells.
Q278 Chair: That in itself is extraordinary. That really is a sign that there needs to be more transparency within the organisation, so that officers and members know what these answers are without having to FoI them.
Gerry Murray: Yes, absolutely.
Warren Scott: Just in addition to what my colleagues have already said, we welcome hearing from the Chief Constable his comments about it being sobering and about him almost being as shocked as the rest of us in relation to the report. Our main concern was that blame was going to be levelled at an individual person or an individual department, so it is great that the PSNI has taken on board that this is actually a fault of its own. It has taken full responsibility for that, and that is extremely welcomed.
In relation to recruitment, since this has occurred, we have had a number of recruitment campaigns. One of them resulted in 75% of people not moving forward to the next stage due to it. It is showing the impact of what the members of the public and people outside of the organisation feel about the risk of possibly becoming part of the police family.
Finally, on transparency, that is why we are having to get a lot of FoI requests, even for members ourselves within the unions. We are unsure why someone has got this position, perhaps, over someone else. Instead of it being completely open and transparent, lists being shared and who is going where, there is an element of that. We would welcome some sort of review of that, to enable it to become more transparent for all. That will cut back on the work within the organisation.
Q279 Sir Robert Goodwill: I recall in September you all gave very powerful evidence on the personal impact that these data breaches were having on officers and staff you represent. Obviously you are all in public‑facing roles, but many of your staff can live in their communities fairly anonymously, and that has been completely blown out of the water in some cases. Could you provide an update on the mood of your colleagues now and, if you are able to at this early stage, outline how they have responded to the review? I will start with Superintendent Murray, because your members probably feel some of the most vulnerable in the community.
Gerry Murray: Our members are still fearful and still anxious. When the data breach occurred it was the middle of summer; we were all with our children and grandchildren enjoying the summer holidays. We are now into the middle of winter, where most of our staff and police officers are going to work and coming home during the hours of darkness.
My people are fearful. I will give you an example. A young female officer within the Catholic Police Guild whose children are not at school age would normally have left her two children with the grandparents in west Belfast. That is not happening, and the childcaring fees are increasing. That is an additional finance on the individual, whereas a female police officer with children from a different community background still has the extended family where she is able to leave the children in an area that is not associated with violence.
I spoke to an officer who had resigned from the organisation with regards to the data breach, and he is relieved that he is out of it and the pressure is off his family. I have spoken to 29 of my officers within the Catholic Police Guild who have gone out and bought camera equipment and doorbell cameras, long before we had the universal offer from the senior staff within the organisation.
This will go on for some time. This will not be resolved this year or maybe next year, because the fear and the exclusion that some of our police staff within the Catholic Police Guild and police members feel is still very much with and about them. Some of the things that they are telling me would change their lives with regards to any social interaction, be it with the Gaelic Athletic Association or football clubs. There is that fear, and it is the fear of the unknown and the darkness. They do not know what is coming before the dawn.
Liam Kelly: As I explained the last time I appeared before you, there is a spectrum of impact. The report picks up on that. You have ambivalence from some people, right through to palpable fear. As part of the Information Commissioner’s Office investigation and evidence gathering, we have provided some anonymised personal testimonies. It really does give a snapshot of the impact that that is having on not only the officers, but their families.
To pick up on Superintendent Murray’s point, the officers appear less concerned about themselves but more about their families in relation to this. Their initial assessment of Op Sanukite and the PSNI’s initial reaction to this is that the tangible, practical support was negligible, and still is to this point. Only yesterday did we get some detail around the universal offer. The first we were notified around the universal offer formally was last Friday, when temporary Deputy Chief Constable Todd put an email around the Police Service. The details of that are still to be finalised. In fact, the Chief Constable has indicated a payment of perhaps up to £500 towards some of the security measures that Superintendent Murray has mentioned. Unfortunately, we live in a world where things are relatively expensive. In fact, some of those personal testimonies are saying that officers could not afford to actually start to do things like that. They were taking some pretty drastic decisions around trying to protect both themselves and their families.
There is also the hidden aspect of the impact. What we have seen is a massive increase in people presenting themselves to occupational health to ask for help and support. Unfortunately, our occupational health within the organisation has been underfunded and under-resourced for a long period of time. Just to give you a snapshot of the waiting times, there is an eight‑month waiting list in the PSNI to see a psychologist. You can imagine the personal impact on someone who is struggling with their mental health if they cannot see and talk to someone for maybe eight months.
Sir Robert Goodwill: It might take some time to actually pluck up courage to come forward in the first place, so that is additional to the eight months, I suppose.
Liam Kelly: We have also seen an exponential rise in the number of officers who are citing the data breach as the final straw for them in relation to either staying in service or applying for ill health retirement. This year, we have 199 people asking for ill health retirement. That is a 100% increase on normal. Again, the data breach is being cited as the straw that broke the camel’s back, really, for people. They feel let down by the organisation, unsupported by the organisation, and cannot see a pathway of coming back to the organisation. That is extremely frustrating.
Just to reaffirm the point that the chief made yesterday, we have seen a strong resolve from the vast majority of officers to get about, continue to serve the public and do their job, which is fantastic to see. However, at the other end of that spectrum we have a lot of people who are seriously struggling over what has happened. As Chief Superintendent McNally has highlighted, there needs to be some significant financial investment here to enable the PSNI to deal with this effectively. That is not just the outworkings of the costs that are going to be associated with building up the processes, procedures, hardware and software required to protect data; that investment is going to be required to assist the officers to manage this.
At 2.6, the report says this cannot be undone, and that is true. I mentioned last time that the genie is out of the bottle. We are now managing the consequences of this, not only this year but for years to come. That is going to take time and money. The concession made yesterday around the individual support for the universal offer, by my sums, equates to about £5 million. I do not know whether that was factored into the PSNI’s budget case made to Treasury in September, which Mr Todd had referred to as costing between £24 million and £37 million just to stand still. As far as I am aware, there has still been no response to Treasury in relation to that matter, which at this point, four months on, is pretty disappointing from our members’ perspective.
Just to sum up in relation to the impact, what we are seeing is that our officers are committed to doing the best they can, but people are struggling and looking for help, and unfortunately that help is really either negligible or so far down the line that they are now looking at alternatives. One stat that the Chief Constable did not mention yesterday, but he has mentioned before, is that 50 of our officers have applied to go to Australia. That is just extraordinary. In years gone by, you could count on one hand the number of people who would do that. We now have 50 officers who have put themselves forward to say, “We no longer think we can serve in Northern Ireland, but we want to remain within policing,” and Australia is the option for them. That is extraordinary.
Q280 Sir Robert Goodwill: Is it affecting recruitment? Obviously new recruits will not have been subject to the data breach. Is it deterring recruitment?
Liam Kelly: The problem is that we do not have any recruitment. The recruitment stopped in April of this year. The Chief Constable has indicated that, as a result of the deficit budget and his inability to keep people safe, he may have to set aside his accounting officer responsibilities and actually just say, “I need to bring people in,” because the number of people leaving is resulting in the organisation shrinking to unimaginable levels.
As Detective Chief Superintendent McNally has mentioned, the projection by March next year ordinarily just on retirements would bring the organisation down to 6,358, but if you factor in 50 people potentially going to Australia and 199 people potentially on ill health retirement that number is getting closer to 6,000.
Sir Robert Goodwill: We heard that earlier.
Liam Kelly: On a day-to-day basis, the PSNI has around 500 officers and staff off on sickness absence. The number of people who are front facing in the organisation is diminishing by the day, with no new people coming through. This is one of the important things about confidence in introducing the measures in the recommendations. Someone looking in wants to be confident that the PSNI will protect their identity, protect their data and have their back in relation to these matters. It is going to take time to do that. The report is the first step of that process, but it is certainly not the last step. It now needs to be implemented, and it needs significant investment to do that.
Q281 Sir Robert Goodwill: Detective Chief Superintendent McNally, how many of your officers are public facing and would be known to the public, as a proportion?
Anthony McNally: Probably 60% to 70% would be in public-facing roles, but there is an acceptance that at a senior level you are likely to be a public figure. I will not repeat the points that Mr Kelly made. I agree with him. From my perspective, and certainly on behalf of the Superintendents’ Association, there is that broad church of views. There are those who accept that they are in public-facing rules and therefore probably less concerned by it, but there are those who work in covert roles and who are deeply concerned.
As I reflected here last time, I referred to it as being like Covid. Operation Sanukite was something new. There was no playbook and no rulebook as to how you work your way through this, so it is understandable that there was that culture of fear. Policing is diverse in terms of people’s views, and that is why you have that broad spectrum of some being in that culture of fear and some being not so concerned.
It is important that we address that. We recognise that and have worked hard to try to address it. As an association, we created four strategic intentions back in the summer, which were, first, to work collegiately with our staff association colleagues; secondly, to support our collective members, but also to support our own individual members; thirdly, to work with the organisation as a whole to build internal and external confidence in policing; but, fourthly, to reassure the public that we are still delivering an excellent service to all communities. I do not think that could or should be forgotten in the context of what has happened. The PSNI still delivers a fantastic service to communities across Northern Ireland.
We are, and I am, very proud of our members. We have led the organisation, and bear in mind that this was in a period of significant instability. We had lost our Chief Constable and our Deputy Chief Constable, but despite all of that we have delivered that strong service. That is against the backdrop of members having real concerns about the loss of their data.
Bear in mind that the cowardly and callous attack on our colleague John Caldwell, in front of children, was still this calendar year. The right of police officers and staff to have their personal information protected as best possible cannot be forgotten.
As I said, we welcome the report. We also welcome the stability of the Chief Constable and the Deputy Chief Constable to lead us through this. It is important to put on the record, as I mentioned last time that we felt there was a disconnect in the run-up to Op Sanukite, that I do not feel that it is the case anymore. I feel that there is a real collective desire across policing to build that internal and external confidence.
As I said, we welcome the report. We welcome the opportunity to work through it, but I reiterate that it will require significant funding for us to be able to deliver, not just to keep our data safe, but to reassure our staff and our officers that that is the case, and to continue delivering the excellent policing service we do. What we cannot do is focus on this to the detriment of something else, so that is why this is additionality and has to be funded in that way.
Warren Scott: I mirror the comments of my colleagues in relation to it all. Where I would slightly differ would be that a lot of our members and staff joined the organisation with the knowledge that they would not be forward facing and would be in the back office. A lot of people from mixed communities who would like to give back to the community joined as staff, knowing that they could assist but that they would not have to be put out there as a police officer, returning to their place of work, having to move home and all these additional items. Some of these people have now been forced out into the spotlight.
Just by way of example, we have one male who lives in an area that would not be police friendly. However, with his back-office job there was never an issue. He simply worked for the civil service. Now that his details are out there and he has a unique surname, he is now at risk. His concerns and the stress of it all have led to him being off sick. He can no longer take his kid to the local GAA training, because obviously there is a timeline to it; it is a regular occurrence somewhere, so he would have concerns. He has pulled his wife away from some clubs that she joined. A job that he is meant to be working from nine to five is now affecting his life 24/7.
The main issue I have about that is that the organisation as a whole is not taking full responsibility for the impact of that. It states that there should not be a mitigating circumstance around his sickness and it should fall within the current policy, but the issue is that the PSNI has created this. This is how it has affected this person—maybe not everybody, but everybody is on a scale. He is at the top end of the scale, and yet there is still a refusal by the PSNI to accept that it has to look at this and maybe implement an additional policy for those affected that way.
There is a fear as to how we now recruit. The civil service in Northern Ireland is about to come out with 900 jobs, and we mirror it by grades. You would get the same money working for the civil service without working for the PSNI under severe threat, where there are issues and concerns that your data could be leaked.
We have real concerns as to how we continue to bring staff into the organisation, supplemented by the fact that we get a revised environmental allowance, which is just above £500. It is the equivalent, I suppose, to danger money. The police officers are getting £3,666, which is perfectly acceptable for the role they do. However, without an improvement in ours and making it look like more of an employer of choice, we are going to have great difficulty in bringing civilian staff into the organisation in the years to come, which will then mean police officers off the ground, at a higher cost, and if they are in offices doing admin roles they are not out there dealing with crime, which is what they are there to do. That is the main issue and feeling coming back in from our staff and our concerns at the minute.
Q282 Claire Hanna: Going back to the review and the clarity of the review, specifically, in a description of the actual event, the report notes that Person 5 removed all visible tabs, and then five to 10 minutes later they deleted all the visible tabs, with only the response tab on screen. Is that sequence of events clear to you? Are there any questions that you would still like answered that the review did not address or conclude on?
Anthony McNally: Never having worked specifically in that environment, in relation to human resources, the freedom of information team and the communications department, which are the three points of the triangle where these requests would ordinarily go in, I understand the theory behind it, but in practice, no, I have never dealt with one of these requests.
My role and what people like me would do would be to quality assure some of the information. For example, if it is a request around the number of investigations being undertaken within the public protection branch, that would come via that triangle to me to provide that qualitative oversight into it. On a practical level, no, as I say, I would never have dealt with that, but in theory the report is clear.
If I may just elaborate on the report, because you have specifically gone to that, it is really helpful on one hand, particularly recommendations 11 and 17, which are around simplifying and streamlining processes. Recommendation 11 talks about the freedom of information standard operating practice, and recommendation 17 talks about streamlining service procedures. That is very much welcome.
Again, I want to reiterate that, having been around policing long enough, recommendation 5 is about setting up a data board chaired by the SIRO and so on. Recommendations 34, 35 and 36 are about a training needs analysis, delivery of training and recording of training. That sounds like a governance board, which is going to require a lot of admin and support. The point I make is that, if there is another governance board that brings all of that energy and drive behind it, there are now 6,000 police officers, potentially fewer than 6,000; the work still has to be done by those out in the field, i.e. me. That is where I see the challenge. That is why I keep referring to the fact that we need additional financial support to be able to do this on top of our day jobs, not as part of our day jobs, because we just do not have the capacity to bed it into an already busy day.
Claire Hanna: That point is well made. We have other questions about technical issues as well. [Interruption.]
Chair: There is a fire alarm, so I must suspend the sitting.
Sitting suspended.
On resuming—
Q283 Claire Hanna: Mr Kelly, are there any questions that you would still like answered that were not addressed or concluded on in the report?
Liam Kelly: In relation to the event, as it is termed in the report, it has reinforced what we understood to have happened. It reinforces the recommendations in the report about siloed working. A lot of people in the organisation do not fully understand how this could have been missed in the circumstances, as has been laid out.
One of the things that the report picks up on is about assumed knowledge in relation to reports. I completely concur with that. Much as a lot of people in the organisation would use certain Microsoft software products such as Outlook, Excel or any of the others, they have never been trained on them. This is something that you pick up as you go along or when someone shows you.
The report mentioned the three dots approach. That was the first time I had ever seen that. When I went through some of the spreadsheets that we keep in our offices, which are outside the PSNI systems, I noticed that button for the first time. If you were not looking for it and you were not trained to see it, you probably would not have seen it. Again, it is a wee bit disappointing that we have people working in that area, who are deemed to be professionals in it, but who have never picked up on that or seen it before.
Q284 Claire Hanna: We understand that SAP, which is the technical system that was used—it ran a chill down my spine; I used it a lot in a former job—is coming to the end of its life and it does not apply classifications to documents. What do you make of that?
Liam Kelly: There has been a human resources review that has been going on for some time. One of the recommendations from that—it is the same for occupational health—was about how the internal systems did not talk to each other. They were operated in a silo environment. SAP is antiquated and requires a major update. For me, the learning coming out of this is that people who move into the HR world are taught some of this stuff by their peers rather than having bespoke training. Bespoke training is one thing that has been mentioned around this.
The overall thing around the freedom of information process is that there was not one single standard operating procedure being used. A person’s own experience or their line manager’s experience would dictate how that process worked. There does not seem to have been any corporate knowledge around that. When people moved on or were not there, the next person did not pick up on that.
This has shone a light on a number of failings. Again, of the most important recommendations is to have proper training put in place and a standard operating procedure in play specifically in relation to FoI matters.
Q285 Claire Hanna: Superintendent Murray, were there any questions that were not addressed or concluded on by the report? Do you have any comment about that technical system that you are still using going forward?
Gerry Murray: I am in the operational support department. The SIRO would have been the ACC in the operational support department. Because it was given to one section of the organisation, the rest of our organisation just sat back and said, “We don’t have to worry about that. Somebody else is taking it.” I commend the new Chief Constable because he sees the issue. At a minimum level, the SIRO needs to be a Deputy Chief Constable so that the whole organisation takes note of what the Deputy Chief Constable says with regards to information security.
I also have to point the finger at the Policing Board and its governance failure. The Policing Board’s role is to check and counter-check what we are doing internally. We have a governance failure here. I believe the Chief Constable and the Policing Board should now not only look at, as the document calls it, protecting from within, but they also need to be assured that they have the right people who can carry out the right governance-protective investigation so we can be challenged.
Q286 Claire Hanna: Will the planned review of the Policing Board achieve that?
Gerry Murray: I would leave that to others, given that I am coming from the operational support department. If a governance failure could happen in the past, it can happen in the future. They need to put in place the procedures to challenge what the police are doing with regards to information security.
Q287 Claire Hanna: Does anybody want to add anything on unanswered questions and the viability and security of that system going forward?
Warren Scott: In addition to that system, I would have some queries about the implementation of the new GDPR principles that are mentioned within the document. There is talk about them coming in in 2018. At this stage it is 2023 and there are still elements of that that have not been rectified by the PSNI. The scope for that was 18 months from introduction. We are still sitting here in 2023 with some of that not completed.
I would be curious about what has not been done and whether there are any issues that we should be worried about going forward in terms of data loss or leakage.
Q288 Jim Shannon: Gentlemen, it is nice to see you. Thank you for coming along, as always. I have a quick follow-on question from Claire’s. I will probably go straight to you, Gerry. It is about the Northern Ireland Policing Board’s inability, for whatever reason, to understand the issue of data and information handling. We are quite concerned about that.
In terms of the way the Northern Ireland Policing Board did not respond, the report recommends some changes, and rightly so. If we are going to improve, those have to happen as well. Are you content with these?
Gerry Murray: I have not yet had the time to sit down with the committee of the Catholic Police Guild to review the full content. The fact that we are raising the issue here should send alarm bells to the Policing Board about the fact that this has happened on its watch and could happen on its watch in the future. It needs to look for the people it requires, who have the experience and expertise to challenge governance.
That is what I would be asking the Policing Board: to have the proper application, implementation and the resources to do what it is supposed to do, which to enable us to do our job. We need to protect ourselves internally through freedom of information, but we can only do that if we are challenged externally. It may be that the Policing Board looks to external people to come in to do a deep dive with regards to aspects of information security.
Q289 Jim Shannon: I would also emphasise the personal impact and the traumatic effect that it had on those who were under personal threat. Take the issue of PPWs, for instance. A number of officers who came to me had applied for PPWs, but their applications had not been processed. I had to give them to the Secretary of State for Northern Ireland and ask him to look at them personally and get involved.
These things should never get to that stage, should they? My goodness, I do not know. I despair when I have police officers coming to me who have had threats made against their persons. The firearms branch has not grasped it—really?
Gerry Murray: The issuing of firearms licences rests within the firearm certificates issuing branch. Each application that comes before the people in Lisnasharragh will be looked at on its merits. Every police officer has a PPW, but I am aware that some officers have asked for an additional PPW. I am not sure of the content.
Q290 Jim Shannon: Not every police officer has a PPW. They cannot take a weapon home with them. Therefore, it is not a PPW. That is not entirely correct.
Gerry Murray: If there are restrictions with regards to police officers being unable to take home a PPW, that should be brought back to the firearms access panel. The firearms access panel will be able to review it after liaising with the federation representatives who are on that panel.
Q291 Jim Shannon: I understand, Gerry. Thank you for that. The frustration is that it has not been clarified, and all those processes, as you have laid out, have not delivered. We went to the Secretary of State for Northern Ireland because he has the final say in the matter. I have no doubt at all that this will be approved, but it is frustrating for me, as an elected representative, to go through this on behalf of my constituents. Honestly, I wonder what world we are all living in.
When it comes to the issue of data extraction, this seems to be a process that was handed down over the years. It was custom and practice, “This is how we always do it,” and maybe it become a wee bit laissez-faire. Therefore, the robust oversight that is needed was not there. Is that your impression of what happened as well?
Gerry Murray: Complacency does creep into many public sector organisations. If I look to my colleagues from the federation, my colleagues from the Superintendents’ Association and my colleague to my left from NIPSA, we have more demand and fewer people. Therefore, the amount of time, effort and accuracy that we have is being eroded away because we are under time constraints to return a document, a draft issue for the Policing Board or a draft issue with regards to freedom of information, where we are under time constraints in terms of days. Because there are fewer people checking the accuracy, we will make mistakes. The independent review team has identified this in its recommendations. With finance and resources, it should not happen again.
Warren Scott: The FoI department itself is currently seven staff down against the recommended number required to carry out this role safely. It is already running seven below where it should be. That is all linked into the financial aspect and not being able to bring them into the department.
That is the issue. Everybody is doing a little bit of extra. They are rushing to get this stuff out and to make sure that they stay within the compliance times and response times. That is the issue. There are emails out to try to get the staff in there. However, there is a full process around where we take them from because you are going to have to rob Peter to pay Paul in order to get them in there. You are then leaving somewhere else weakened.
If we have more money and more staff, and if the correct training is provided on the usage of these packages, they will be able to go through it sufficiently. To take as an example the details released by that person, he is looking at the content that is there. That is it. He is not checking through the document to see whether there are any additional data leads or anything along those lines. At that level, that is not what his skillset is. All he is reading is, “Can we release this element?” You needed someone skilled in the package of Microsoft Excel to read through it and ensure nothing has been added to it. With staff, money and the appropriate training, we hopefully will not have to deal with this again.
Q292 Chair: Inevitably, as we have looked at the issue of FoI, a lot of other questions have come into play. While the recommendations within the review are clear and helpful, and there is indeed at a later stage a reference to culture, are we not perhaps in danger of missing a fundamental point here?
Before we get to the processes of FoI, we need to make sure that the information that should be in the public domain is in the public domain so there are fewer FoI requests. Frankly, there should be a culture with a target of reducing the number of FoI requests year on year, particularly from within the force, which then is a reflection of the fact that the information is already available.
What observations would you have about ways in which the PSNI could do that? In fact, this is not just a problem that the PSNI has; it is a problem that we have across Government. What more could they do not just to change the culture but to operate mechanisms that ensure that the information that should be in the public domain, in a safe way, is out there?
Liam Kelly: Just to pick up on what is in the report, the report’s author comments on the extraordinarily high number of internal applications. They are about 20% of the overall number, which is extraordinary. In his experience of data and police services handling data across the UK, that figure was the highest he had ever seen.
There is an element of distrust within the organisation, which I would say stems from a lack of confidence in the processes and how things are done. This is an opportunity for the PSNI to try to level the field in that regard and to be more transparent.
The two principal issues relate to promotion and temporary promotion, and how those processes happen. That was the genesis of this data breach. It was a request that came in around how many temporary promotions were in service and where that is.
It is an opportunity for the PSNI to address its workforce and say, “We need to be more open and transparent around some of these processes and how they work.” That would assist in lowering the actual number of applications that are made. Unfortunately, that is another bit of work in progress. There is a lot of distrust in the organisation and a perception of organisational unfairness around things.
This is one of the outworkings of the reducing budget and the organisation being unable to promote people substantively. It is filling gaps with temporary promotions outside of having promotion processes. Those processes are dealt with in different areas by different people in different ways. That causes confusion and resentment. If they do not get the answers they want, this is the only mechanism they have.
Q293 Chair: Could they cure that by publishing the criteria for both permanent and temporary promotions? Would that be a way to do it?
Liam Kelly: They have tried to standardise the processes, but, again, particularly when you are moving into specialist departments and things, you cannot put a square peg in a round hole. Not everybody is suitable for a particular role. When they put in “desirable” or “essential experience”, sometimes the perception of others can be that a job has been allocated to or designed around one person and one person only, which causes that narcissistic approach for people when they are there.
There certainly are things that they can do to be more open and transparent around that. The biggest departments in the police are district policing commands, which cover the three areas of frontline policing, crime ops and ops support. You could easily do that in district policing command and have some consistency across the three areas.
Unfortunately, at times the demand in particular areas causes the organisation to have to step outside its processes, because it cannot get people to put themselves forward for particular posts—perhaps they do not want to pigeonhole, or constrain themselves if a substantive promotion comes in and they are told, “You are doing the job temporarily. Therefore, you can stay.” Maybe they do not want to stay. They might just be doing it for financial reasons at that time; they might actually want to work somewhere else in the organisation, but they find themselves stuck in a particular area. At times, there is a reticence for people to step forward. As I say, the bigger issue is people thinking that they are being pigeonholed or overlooked for a post because of processes that are not as transparent as they could be.
Gerry Murray: The fact we are not open and transparent—and there are areas within the Police Service of Northern Ireland where we are not—is reflected in an increased number of grievances and industrial tribunals. Those are impacting on our own finances, which are very limited at the moment.
The fact that 20% of freedom of information requests are internal would lead me to believe that a majority of them may lead to industrial tribunals at Killymeal House at the Gasworks. Therefore, the more quickly we become more open and transparent, the more quickly we will be able to reduce the number of police officers and police staff being involved in industrial tribunals, whether as the victim or as someone supporting the organisation.
Q294 Chair: That is really interesting. I would like to know more information about the proportion of industrial tribunal cases that involve police officers, to see whether that is strikingly different from the norm in other parts of the UK. If it is, it would illustrate a very litigious approach to industrial relations. Is the FoI process itself like an informal disclosure process, which is a part of or preliminary to litigation?
These are very serious questions. As a Committee, we would like to help answer them. I do not know whether any of our other witnesses want to come in on this point.
Warren Scott: As part of the staff association, some of the information is not being provided when we are asking for it. We are having to put in FoI requests to get certain information.
For example, that might be around persons who have had adjustments for DDA. We understand the GDPR principles, but we are seeking to make sure that a fair decision has been made for one individual, so we want to see how many people in the last three months have been given an adjustment. When we are not provided with that, we are going to FoI and getting the information that way. It slows down the process.
To answer your question, most of my FoIs are linked into something that then goes forward to a tribunal. That is the reason. If we could get the answer back and it was not the case, we could just turn around and say, “Here is the proof that you have not been victimised.” However, we have to wait until we have filled in the forms and gone to the Labour Relations Agency. It is a lot of work for us and for the FoI team that does not need to happen, especially if you are transparent.
It is about transparency. As Liam said, it is also about the standardisation of some of the processes. The problem with policing is that it is fast. If a sergeant goes off, you need a sergeant in tomorrow, not in three weeks’ time after you have done a process. Locally, people will say, “We need somebody who has 10 years’ experience,” but the people who have seven or eight years’ experience will be thinking, “Why am I not being included in the options for this?”
If we standardised these local temporary adjustments throughout the organisation and followed one process, it would stop a lot of this. We need that transparency, especially for the members of this panel. If you are asking for information and you have a legitimate reason to be asking for it, you should be provided with it. You should not have to go outside like an external.
Q295 Chair: We all understand that there is always a risk of identification if the data reveals perhaps only one or two people. Bearing in mind that we are all here because of that issue, as a Committee we understand that, but it does seem to me that prevention is the best form of cure. Perhaps it can be worked out using other organisations as a comparator, although of course we know that in many respects the PSNI faces unique challenges. The Committee will come to its view, but setting some clear targets and aims to reduce FoI over a period of years could be a way in which the PSNI incentivises a change in the information culture. I do not know what you think about that.
Anthony McNally: I understand the concept of setting targets, but I would worry about some of the unintended or perverse consequences of wanting to reduce this when we are trying to be more transparent. There is a counterbalance to be struck.
You touched on this yourself, Chair, but Mr Boutcher has said recently that, from his experience over here, Northern Ireland has by far the most scrutinised police force across the United Kingdom. Therefore, it is understandable that we scrutinise ourselves and that police officers do ask these questions maybe more than others would. That is probably a cultural thing as well.
We have identified opportunities here. It is important to reflect that. Outwith the core data protection piece, there is something around culture and standards. That is reflected within the document. While it is reflected within the document in the context of this area of work, for me there is a bigger piece. We have just completed our cultural audit, as has been mentioned. We have a “Your Voice” forum. There are already some pieces of work going on around promotions and temporary promotions, which would really help.
Certainly, from a staff association perspective, on behalf of the Superintendents’ Association, we should already be thinking about this. The one challenge that we have laid down—I have laid it down to myself as much as anyone else—is that we do not have career pathways. We are not particularly good at, “What does this look like in five years’ time? How am I going to get from an inspector to a superintendent?”
There has been a constant shift of processes, not only in how they are constructed but in how they are delivered. Those are challenges that the organisation has identified through that audit. I believe there are processes in place around that to go forward in terms of how we learn. Those structures are presently being built.
Going back to your point around how that links directly to FoIs, I would look at it more broadly than that. I would be asking about the internal confidence and satisfaction levels of staff, which might be an indicator, as well as the number of FoIs. From our surveys, how confident do our staff feel about promotion processes, support and continuous professional development? Those softer questions around future surveys might equally inform what we need to do to make sure that staff feel comfortable that their organisation is supporting them.
Q296 Chair: Following on from that, there is a generic question based on the recommendations in the review particularly about staff grades involving data management, the generic recruitment of staff there and perhaps the undervaluing of the skills required. It does seem like you are recognising that that is a legitimate finding. Are you content with the recommendations in the review as to how to address more importance being given to data management skills?
Anthony McNally: There is no doubt for me that there are specific aspects of policing—when I say “policing”, I mean that in the broadest sense, including finance or IT—where there is absolutely a need for those significant and dedicated skills. That has been a cultural challenge for us as an organisation in terms of both police staff and police officers. You can perhaps work in forensics one day and in another area of business the next. We have seen that recently. That is not a criticism of those individuals; they all do great jobs, I am sure, but there is something about how we appoint people into roles.
Again, I would go back to career pathways and the potential for promotion. If I join as a junior forensics person, can I have a career in forensics and work my way up the chain as opposed to having to move into FoI or something else? There is something about that both for police staff and police officers. That is definitely reflected in the recommendations. The recommendations around that are absolutely sound.
The recommendations as a whole, as I said, are absolutely fine. My concern, as I mentioned earlier, is just around our capacity and capability to be able to deliver those alongside everything else. When you look at it, it is not like we were blind to this. There were governance boards in place. Arguably, there were some concerns around areas of business being marked as green, as in being completed, when they clearly were not. There is evidence to suggest that we knew there were some underlying issues here, but perhaps we just did not have the capacity and capability to deliver. Again, I would reiterate that point. As good as the recommendations are, we need time, space and money to deliver them.
Warren Scott: I have one issue in relation to the report. The report mentioned staff and non-generic grades. It specifically referrs to the EO2 band and goes on to the potential to bring in EO2 paralegals. I understand that the report does not really lay the blame on any single department or grade, but the fact that there is a recommendation for a complete change at that grade indicates that they think there could have been a slight failing at that level.
Whenever we have been able to review it, the issue has been that they have collated the information and the information has then gone through a series of checks, yet that is the only grade for which a full change has been recommended. The fault does not fall anywhere with them so we are not fully on board in relation to having to change them from generics to paralegals. I understand the reasoning behind the additional skillsets, but that department is up in the high 90s in relation to return rates back to the ICO. It is overperforming. If any other department in any organisation was working like that, you would not be talking about making a change. It is due to the fact that this mistake happened, but it happened across four or five departments, yt that is the only one for which we are discussing a change in recruitment. We would have a minor issue with it falling on them only, especially because, bar this, they have been successful until now.
Gerry Murray: The one thing I would like to highlight with regards to the 37 recommendations is the energy within this organisation. I have been a police officer for over 50 years. I have never seen a situation where the energy is being sucked out of the organisation.
If we are going to implement the 37 recommendations, it cannot be done with the whip; it has to be done with the carrot. The rank and file, from the bottom right up to the top, have to buy into this as being our responsibility. We need to reintroduce what is important internally and externally, and we need to put new energy into the organisation.
I commend the chief with regards to his tenure within this organisation. He has started. He has the right credentials to bring the energy. With due care and attention and the right oversight of the 37 recommendations, we can put ourselves on the road to recovery.
Liam Kelly: I have a few observations to make on the cultural skills and talent recommendations. You could apply this to any specialism within the PSNI. For example, with Mr McNally in public protection and Mr Murray in ops support, we invest considerable sums of money in training people, but we do not invest considerable sums of money in retaining them in those positions. If those officers are interested in promotion or lateral development, the ability for them to do that within those particular areas diminishes.
It is something I see time and time again. I will give you an example from district policing. If there is a neighbourhood officer who wants to go for promotion but there is no vacancy for a supervisor in the area they have been working in for the last 10 years, that skillset is lost. In fact, they do not even go into neighbourhood policing. They go in back into local response policing and things like that. That skillset is completely lost. At some point in the future, someone else has to come in and start again from the bottom up.
Yes, it is very important that we have the pathways available for people, but, as I see it, every specialism in the PSNI needs to focus on this. When I first joined the police—it was not as long ago as Mr Murray—almost 30 years ago, there was talk about tenure being implemented following the Sheehy report. The staff associations were for and against it in some regards,. We were saying that it is difficult for people to progress in the organisation if a pathway is closed because someone is in a role forever. There was talk about five years. Ultimately, those things were never implemented because it was impossible to do that in service. The natural attrition of retirement and promotion has been used to create vacancies.
I am picking up on Warren’s point about the lack of resource in that particular area. Again, you could highlight that in almost any part of the PSNI now. We have no recruitment at the moment, so it is impossible to replace anybody who is in any of those specialist roles because the people are not there to do it. The Chief Constable has already put on record that he wants to protect the frontline 999 response. Unfortunately, that is the student officers and probation officers at the moment, which we do not have. That is where the main squeeze is. Yes, I commend the report, but there is a bigger question for the PSNI overall, if it is going to try and bring that in right across the board as opposed to just in information management.
Chair: We remember Sheehy and the response to it. While I understood it at the time, it did raise some long-term questions about the second R, which is retention. As you say, it is as important as recruitment. The PSNI is not alone in being an organisation that faces challenges. I think of His Majesty’s Prison and Probation Service here in England and Wales. The retention of prison officers is a big issue.
Q297 Claire Hanna: You have variously touched on the issues that we are dealing with and how they affect recruitment and retention. Recruitment is on hold, but is there anything else you would like to add about how the data issues have affected staff and how they are affecting recruitment and retention?
Gerry Murray: The recruitment from the Catholic community, from Catholic nationalists and republicans, has been severely dented. Officers and staff now cannot go back to the areas where they were brought up. They thought they were bringing their culture into the organisation through Gaelic football or Gaelic sports and reflecting it to anybody from a different community background. Everybody brings their own culture into the organisation, but, when they arrive at the front door, they are entering a noble profession with a mutually understanding and appropriate language guide within the organisation.
I remember when we met the Chief Constable at the service leaders’ engagement forum. One of the first issues I asked about was the recruitment of Catholics. We should not be standing still with regards to recruitment, whether it is from my community background or a different community background. Even though there is no finance, we should still be moving forward.
Hopefully next month, January, we will have the school fairs. We should be front and centre in the schools fairs. Specifically, all the minority associations have a great role to play. Each of the diverse communities within Northern Ireland, in the last census of 2021, should be reflected in the makeup of the police. The communities that we serve should see themselves in the police, through the police officers and police staff who are serving the community.
Chair: Yes, agreed.
Warren Scott: My colleagues have already pointed out the pause in recruitment for police officers. I mentioned earlier the stat that 75% of people pulled out of a recent recruitment campaign. That was for a CDO, a civilian detention officer. They are the civilians within custody who deal with prisoners and help them get booked in, and 75% of them pulled out of one recruitment campaign. That really shows what the public think about having the PSNI as an employer.
Because we do not have those resources, police officers are coming in from response on the ground to cover the roles that are meant to be covered by those CDOs, which is a complete knock-on effect. Something needs to be implemented to make it an employer of choice, whether it be by putting a bit of trust back out there or, again, a revised environmental allowance. I know what has been requested. It has gone to the Policing Board; it has now gone to the Department of Justice.
To ensure that recruitment continues, there has to be some sort of value added to the fact that you are going to work in these conditions while under a high level of threat. There are not going to be enough police officers to do policing without them having to come in and cover civilian roles as well. It is just a knock-on effect.
Liam Kelly: One of the main outworkings of the report is about restoring public and internal conference in policing. I have no doubt that the data breach has had a massive detrimental impact on future recruitment. I have no doubt about that whatsoever. This report is an opportunity for the PSNI to demonstrate its desire to improve around this and to demonstrate that, as I mentioned at the outset, it has officers’ backs and will protect and support them as best possible.
One of the other unintended consequences of this was the impact on officers’ confidence in the intelligence system. That was shaken originally this year by the abhorrent attack on Detective Chief Inspector John Caldwell. That really detailed pre-planned operation was not picked up in any way by any of our internal or external intelligence services.
While the PSNI has an emergency threat assessment group, there is a perception among individual officers in service that the organisation’s intelligence assessment is not a reality. They have raised legitimate concerns using that traffic light system—we mentioned the red, amber and green scenarios—and the organisation has graded them as green.
These officers are saying, “As a result of this, I am more hypervigilant about things. I have paranoia around this. I want to be able to go to my social club. I want to take my children to their clubs. I want to do X, Y and Z. You are telling me that everything is okay, but you got it so wrong in John Caldwell’s case, maybe you have got it wrong in my case as well. I am not willing to take that risk.”
That is why we see people going to extraordinary lengths. It is alluded to in the report. One person moved house. They are not confident in the intelligence assessment that the PSNI is giving them or that it is going to protect them in the long term. As I have said, the genie is out of the bottle. This will have consequences and ramifications for years to come, so it is important that this report and its recommendations are implemented.
The big question around that is, “Where are the finances coming from to do this?” It is going to take a significant investment. It is not something the PSNI can absorb within its existing internal budget, which at the moment is sitting with a deceit of £52 million.
Q298 Claire Hanna: That is a really important contribution about the overall context, environment and the challenges that the PSNI is facing in terms of reduced numbers and heightened concerns. This is just one more layer of those anxieties and challenges. Your point is very well made about the additional resources that are required to address that. That is something that, as a Committee, we will certainly be trying to assist with.
DCS McNally, is there anything that you want to add?
Anthony McNally: Recruitment has been well covered by my colleagues. Retention is clearly a very important aspect for us as an organisation. There is no doubt—you used the phrase yourself—that this added another layer on top of the concerns that people have around retention and staying within the organisation. That has been compounded by this data breach. Of that there is no doubt.
Liam referred to the attack on our colleague DCI John Caldwell, but there are broader issues. This is another layer, but let us not forget the broader issues. Colleagues in England and Wales have now been working for four months with a 7% pay rise, which colleagues in Northern Ireland have not yet got. That does hurt. It compounds the frustration that they feel one month after this data breach occurred.
There are broader issues with retention around representativeness. Within my own rank, as a chief superintendent, we have two substantive female chief superintendents. That is quite frankly not enough in an organisation that is 35% female. That is way out of kilter. There is a lot of work to be done.
While there are challenges, I believe we are a learning organisation. We have shown our ability to adapt in the move from the RUC GC to the PSNI and in all the things that we have delivered. As I said at the start, we still do keep the community safe. Northern Ireland is still one of the safest places to live in the United Kingdom for our communities.
What you see in the cultural audit is a workforce that is committed. We know our officers and staff are fully committed to doing the best job they can, but we need that broader support from the organisation, a large part of which is around that financial piece.
Again, I do not want to sound like a broken record, but to deliver what these 37 recommendations ask across five themes cannot be done with 6,000 police officers and our staff support. We need additional numbers, and that can only be provided with additional funding.
The money to fix Sanukite alone is up to £200 million. Taking policing outside of that, £52 million was referenced, but that is to stand still. To invest and move forward, there is no doubt that we need at least £100 million. That is the desire of my association: for us to continue to work with colleagues around this table, with the senior officer team and with everyone in the Police Service of Northern Ireland to keep our communities safe.
Chair: I would like to thank the panel for bearing with us this morning. Despite the vagaries of the fire alarm, I am very grateful to each and every one of you for giving evidence. We will adjourn the session. We have session two on this tomorrow with other colleagues.