Scott Charney, the Microsoft Vice President in charge of Trustworthy Computing, is speaking today at the RSA Conference in San Francisco. He is re-stating both Microsoft’s commitment to “End-to-End Trust” but also the need for business, government and the public to work together to ensure that those using the internet are safe and secure.
The message is an important one: responsibility for internet security has to be shared. The House of Lords Committee on Personal Internet Security, on which I sat, reported nearly three years ago and used a road transport analogy to make the point: safe road use requires responsible behaviour by drivers and pedestrians, but cars need to have safety features embodied in them, roads themselves need to be well-maintained and properly lit, there need to be laws regulating safe behaviour on the roads (speed limits etc) and those laws need to be properly enforced.
If anything the message has become even more important since our Committee reported. More and more commercial and personal interactions take place on line. Social networking sites are booming and an increasing proportion of commerce is conducted via the internet.
The threats to security have also become more pronounced. The threats are no longer from isolated individuals, but from organised crime and it is also becoming abundantly apparent that some nation states are operating in the same way to infiltrate commercial and government networks for their own purposes.
And the technology itself is developing. Cloud computing is becoming the norm and this presents its own challenges. Certainly, this has raised the issue of security for many people (although it is not automatically a given that the security of data held in a cloud is necessarily worse than if it is held on your own servers, particularly if it turns out that they are inadequately protected).
So how do we move forward?
Partnership is certainly essential. Governments have to work together in setting an international framework for collaboration and for law enforcement. And at a national level they must also work with IT service providers and with business in general.
But above all, the individual user must be at the heart of all this. Sensible security arrangements that make sense to the individual have to be devised. It needs to be acknowledged that most individual users of the internet, whether they are trying to do their weekly shopping or organise their social lives, are rushed and busy. Moreover, they are not technological experts. They have inadequate levels of knowledge, so an error message or system alert that makes sense to an IT professional will probably be gibberish to most of us.
And critical to all of this is the need for robust identity management.
Surely, it is not too much to ask that people can feel confident that their personal details are secure, that they can communicate with others secure in the knowledge that the person or organisation with which they are communicating is who it says it is, and that when they are asked to identify themselves they need reveal no more about themselves than is necessary for the transaction concerned.
If today’s discussions at the RSA Conference take us further towards those objectives, we will be making real progress and we can all feel more hopeful that a trusted and secure internet environment is being built.
In yesterday’s Lords Question Time, the Secretary of State for Transport, Lord Andrew Adonis, in answer to a supplementary question I raised, put the boot into Mayor Boris Johnson’s proposal for a new London airport in the middle of the Thames.
The exchange went as follows:
The Secretary of State for Transport (Lord Adonis): My Lords, the Government’s policy with regard to a third runway at Heathrow remains as announced to the House in January last year. We support a third runway at Heathrow, subject to conditions, including an initial limit on the overall number of flights. It is for the airport operator, the BAA, to bring forward a planning application in the light of this announcement.
Lord Trefgarne: My Lords, I am grateful to the Secretary of State for that reply. Is he satisfied that the consultations conducted by the BAA are being properly conducted? They have been widely criticised. In the light of things that have happened since the Government made their announcement in this matter, is he satisfied that their original decision is still correct?
Lord Adonis: My Lords, I am satisfied with the consultations that have been conducted. If the noble Lord wishes to draw any particular matters to my attention, I would be glad to look at them, but I am not aware of any which give me cause for concern. The decision to allow a planning application to come forward for a third runway, subject to conditions being met, has stood the test of time, despite two years of recession. Heathrow is still running at near 100 per cent capacity, despite the downturn in business at other airports. It is our main international hub airport. The lifeblood of our national economy depends on it. This Government will not betray the national interest by refusing to take a decision which is manifestly in the best interests of the country.
Lord Harris of Haringey: My Lords, is my noble friend aware that the Mayor of London has taken up a position opposing a third runway at Heathrow on the grounds of noise and pollution, but in favour of building a new airport floating in the middle of the Thames to the east of London? Will my noble friend comment on whether that policy position is consistent and in the national interest?
Lord Adonis: My Lords, the proposal for an estuary airport has been widely dismissed by sensible commentators, including most of the official spokespeople of the Conservative Party. The official Tory spokesperson says that Boris takes an independent line as Mayor of London. I thought he was a Conservative, but clearly this is not the case for the purposes of this and so many other decisions. Paul Carter, the leader of Kent County Council, the second largest Conservative-controlled authority in the country, says:
“There is a growing consensus that the estuary airport is undeliverable, unaffordable and unnecessary”.
Everybody knows that the European Parliament is at the cutting edge of global political thought.
So it is no surprise to discover that in 2005 (long before last month’s attempted airline bombing made them a world-wide must-have) the European Parliament bought six full body scanners to protect MEPs from being attacked in the Parliament buildings.
Given the legendary efficiency of the EU institutions, it is also no surprise to learn that these six machines – purchased for over 700,000 Euros – have never been used. Apparently, in 2008 the Parliament rejected a bill to permit the use of such scanners across the EU on the grounds that the graphic images provided by such scanners constituted a “virtual strip search”. It is thought that MEPs were not aware at the time that the Parliament had six scanners lying around in their unopened boxes.
After the MEPs had voted against the use of such scanners, European Parliament officials then “rushed” to dispose of the unwanted items. Obviously, there are complex procedures to be followed in such cases, so that the invitation to bid for the six scanners will only be issued in the next few days. The delay, of course, means that, given the current fashion for full body scanning, there should be no shortage of bidders.
But should the European Parliament still be going ahead with the sales, in the light of the latest security threats? Of course it should – as its spokesperson perspicaciously points out, “The Parliament is not an airport”.
Parliament has been prorogued. The 2008/9 Parliamentary Session ended on 12th November 2009 and the new Session begins with the Queen’s Speech on 18th November 2009. I suspect the 2008/9 Session will be remembered for the expenses and other scandals that engulfed both House rather than for the legislation enacted during it. However, some major Bills were passed and became Acts of Parliament. These included the:
In addition, the House of Lords spent seven full days debating the Postal Services Bill, which would have enabled a minority stake in the Royal Mail Group to be sold whilst ensuring that the Group remained in public ownership, would have transferred the Royal Mail’s historic pension deficit to the Government and would have created a regulatory regime for the postal services sector under OFCOM. In the event, the Bill, having passed all its stages in the Lords, was introduced in the House of Commons and then abandoned. The Bill has now fallen with the end of the Parliamentary Session. Three major Bills that have had their Second Reading debates and some Committee discussion in the House of Commons have been the subject of Carry Over motions, which means that they have not fallen with the end of the Parliamentary Session and their progress through Parliament can be resumed in the new Session. These are the:
The number of defeats suffered by the Government this session is the lowest in any full session since the Labour Government was elected in 1997. This session the Government was defeated on 24 occasions (out of 89 votes in total). Last session there were 29 defeats. By contrast there were 45 Government defeats in the 2006/7 session and 62 in the 2005/6 session. To put these numbers in context: the last Conservative Government under John Major suffered only 62 defeats in the entire 1992-97 Parliament.
Labour now has 212 members in the Lords and is the largest Party, but this only amounts to 30% of the total membership of 705. There are 190 Conservative peers (27%), 183 cross-benchers (26%), and 71 LibDems (10%) – the remainder comprise 26 Church of England bishops/archbishops and 23 non-affiliated or other. The reality of these numbers is that the Government does not have an automatic majority to carry through its legislation. At any one time, the opposition parties can combine to defeat the Government, particularly as a significant proportion of the cross-benchers will usually vote with the opposition, depending on the issue.
I joined a visit by the House of Lords All-Party London Group to the 2012 Olympic Park site this morning. The transformation of the site since I last went is impressive. The shape and structure of the Olympic Stadium, the Acquatic Centre and the Velodrome are all clear, as is the outline of the Olympic Village and other facilities such as the International Media Centre.
It is easy to see why the International Olympic Committee are so pleased with the progress that London is making towards July 2012. I remember visiting Athens four months before they hosted the 2004 Olympics. With just sixteen weeks to go the Athens site felt just as much of a building site as Stratford does with thirty-three months to go.
Some of my colleagues slightly overwhelmed our guides with their detailed questions (“Where do the sewers go?”; “What limits are there on architects using their involvement in Olympic projects for their own marketing?” etc). Nevertheless, all were impressed with the progress being made, the sheer scale of the project, and the efforts being made to make the project environmentally and economically sustainable (a large number of jobs and apprenticeships have gone to local people, transport is being improved so that virtually all visitors to the Games will go by public transport etc).
(Incidentally, the Olympic Delivery Authority organises free bus tours for anyone who wants to go – not just interested members of the House of Lords. To book a place phone 0300 2012 001.)
Progress has been so good that I understand that the Olympic Development Authority now intends to hand the Olympic Park over to LOCOG (the London Organising Committee of the Olympic Games) earlier than expected. This may well be unprecedented. It was certainly not budgeted for. As a result, LOCOG will have to find tens of millions of pounds extra to cover the security and management costs for the Park for the extra months.
Today is the fifth full day of the Committee discussion of the Policing and Crime Bill. This is the stage when Bills are debated clause by clause with many hundreds of amendments put forward and considered. There are rarely votes, but it is the opportunity to explore issues and get statements from Ministers on the objectives of particular clauses and how they are expected to work.
I have three amendments down: amendment numbers 152AV; 152AW; and 152AZ. These deal with the arcane subject of which Secretary of State should arbitrate in the case of disputes between airport operators and the police about how much the former should pay the latter for providing airport policing for security purposes (ie is it the Home Secretary or the Secretary of State for Transport?) and, in the event of arbitration, how quickly the arbitration should be carried out.
The House sat at 2.30pm and business began with questions, followed by a statement from Lord Peter Mandelson on the industrial dispute in the Royal Mail. The Committee stage debates on the Policing and Crime Bill then started at about 4pm.
My problem is that there around fifty groups of amendments to be considered and my amendments are about two-thirds of the way through. I am chairing a meeting of the All-Party Group on Policing with Sir Hugh Orde, the President of the Association of Chief Police Officers, that is scheduled to take place at 7.30pm until 9.30pm. When will my amendments be reached?
My initial calculations suggest that the business will be completed around midnight and that my amendments should be reached at around 9.30pm or 10pm. This suits me fine.
However, the first two hours of debate are much quicker than expected – so that by 6pm, I have revised my estimates and am expecting my amendments to be reached about 6.30pm. Again that suits me fine and I take my place in the Chamber ready to move my amendments.
At this point, the progress of debate starts to get slower and the two preceding groups of amendments take fifty minutes as other issues around airport policing are debated. The House is concerned that the costs of security may be such a burden on some of the smaller airports that they will go out of business. So much so, that I am forced to intervene:
“Lord Harris of Haringey: My Lords, I hope when my noble friend responds to this short debate that he will give a categorical assurance that he will not allow the security of airline passengers and those working at airports to be compromised because of what the airport operators say is their financial situation. I trust that we will be given an assurance that, as my noble friend Lord Berkeley said, security and safety will remain paramount.”
In the event, my amendments are reached at 7.20pm and concluded about fifteen minutes later – so I am just able to chair my meeting – albeit arriving a litle breathless and a little late. All part of the unpredictability of trying to fit other activities around duties in the Chamber.
For those with an interest in the arcane. This was the discussion on my amendments:
“Amendment 152AV
Moved by Lord Harris of Haringey
152AV: Clause 77, page 102, line 25, leave out “Secretary of State” and insert “Home Secretary”
Lord Harris of Haringey: My Lords, I shall speak also to Amendments 152AW and 152AZ. I begin by repeating the declaration that I made at Second Reading, of being a vice-president of the Association of Police Authorities and a member of the Metropolitan Police Authority. In that latter capacity, I have been involved in the oversight of the discussions about policing with Heathrow Airport as well as with the non-designated London City Airport, which have been protracted and so far unsatisfactory in their outcome.
The amendments deal essentially with two issues; first, to establish which Secretary of State will arbitrate disputes about airport security plans. I acknowledge at once that it is of course the convention that Secretaries of State are indivisible and that the Government are absolutely seamless and work wonderfully together, but the purpose of the amendment is to clarify who will have the lead on these matters. I also want to establish what time limits should apply to settling arbitration disputes.
The first issue is who will arbitrate in practice. This section of the Bill comprises amendments to the Aviation Security Act 1982, which is obviously a Department for Transport Act, and would imply that the Secretary of State for Transport is the relevant Secretary of State. However, the Bill is also a Home Office Bill, dealing with matters of security and policing at airports, which would imply that the Home Secretary is intended. This is made worse by Schedule 6, which deals specifically with policing plans at airports. It contains similar provisions about arbitrating disputes where policing plans are not agreed. Again, the same doubts apply in relation to which Secretary of State is intended to be the arbiter.
Aside from these technical points, there may be a difference in the way in which the two Secretaries of State might view disputes. The Home Secretary, being familiar with national security threats, might place more emphasis on that side of the equation, whereas the Department for Transport, being more familiar with the concerns of airport operators, might place more emphasis on commercial considerations, which is precisely the issue that we have been discussing in the past couple of groups of amendments.
This has raised some concern that profitability might be put before security—I note the assurance that my noble friend has already given on that point. When it comes to arbitrating disagreements about airport security plans and airport policing plans, I trust that what we will see is the very closest working together between the two government departments. It is in no one’s interest to drive airports into bankruptcy, but it is particularly important to ensure that security is not compromised or suffers in difficult financial times. That means that there should be clarity about what airport operators are paying for, and that should relate to those national security matters.
I hope that my noble friend will offer some reassurance that the statutory guidance to be issued following Royal Assent will include clear mention of the Secretary of State for Home Affairs being involved. I would also hope for my noble friend’s confirmation that such reassurance will be within the guidance issued, that, if the Secretary of State for Transport has the lead, they should be obliged to act in accordance with it in all applicable cases, and that the paramount importance of security in such cases will be uppermost in their mind.
The second issue in this group of amendments is whether time limits should apply in relation to determining arbitration decisions. We heard much in the Committee’s debates on earlier groupings about who has an incentive to put costs up and who has an incentive to reduce them. Equally, there is an incentive for some to allow these decisions to spin out for as long as possible. If you are currently not paying something, then not doing so until 2011, 2012, 2013 or 2014 seems much better than having to pay it now. So the issue of time limits is critical. The concern here is that a decision could, as the Bill’s wording stands, be allowed to drift indefinitely. That would mean that police authorities and forces could effectively be out of pocket for some months or even years before being reimbursed for delivery of policing services. Although this would be alleviated by interim payments where agreements already exist, it could prove problematic where they do not. In difficult economic times, this might in extreme situations threaten the policing presence at airports, if money cannot be found elsewhere in the police budget to tide them over until agreement is reached.
Perhaps more serious, because it is probably more likely, is a situation where the dispute is about who should contribute which services to the security plan. This could lead to prolonged uncertainty and incomplete security cover in some respects. It is clear that that a prolonged arbitration process in these circumstances would add to an already significant risk. Any absence of clarity in these matters could lead to confusion and potentially very serious consequences. It also makes forward planning and budgeting resources almost impossible if a dispute continues indefinitely.
I appreciate the difficulty in setting a single timescale for all possible disputes and I am not sure that three months is necessarily the right length of time—I am willing to be persuaded that it might be, let us say, four months as opposed to three—but I have included it for the sake of debate. I should be interested in my noble friend’s views on what would be an acceptable length of time and how decision-making within a sensible time limit can be guaranteed. I beg to move.
Baroness Neville-Jones: Amendment 152AX is probing. It seeks to clarify the meaning and practical effect of the powers of the Secretary of State in relation to disputes. If the Secretary of State decides not to exercise his power, or exercises that power but the dispute is not resolved, the amendment would allow him to determine the dispute; in other words, if the consultation mechanism does not work properly between the parties, the Secretary of State may step in and take a decision. Under what circumstances is it envisaged that the Secretary of State would not exercise his power to require relevant persons to take steps to resolve a dispute? Can the Minister assure the Committee that it does not affect the obligation of the Secretary of State—a point which arises later in the Bill—to consult those who have an interest in the dispute? In what circumstances would the Secretary of State simply decide that he was going to decide, rather than trying to resolve a dispute with the parties?
Lord Bradshaw: The noble Lord, Lord Harris of Haringey, made reference to security as if it were some curtain to be drawn so that nobody could probe the situation once security was mentioned. One has to be very careful: there are plenty of people who will raise various obstacles to the proper appraisal of things that are put forward. Security can be one; safety can be one; and we all know how many of these things can be exaggerated.
Lord Faulkner of Worcester: My Lords, Amendments 152AV, 152AW, 152AX and 152BG seek to ensure that disputes about airport security plans and police services agreements are referred specifically to the Home Secretary for resolution.
Given the legislative convention, to which my noble friend Lord Harris in anger referred, of referring to a Secretary of State generically rather than specifically, I assume the amendments seek reassurance that disputes will be referred to the most appropriate Secretary of State, who will make a fair and proportionate determination. This indeed is how we want the dispute mechanism to work.
The provisions amend the Aviation Security Act 1982. Disputes are likely to cover a whole range of matters, of which policing is only one element. All airports within the national aviation security programme will be subject to these provisions, but not all will have a dedicated policing presence. As the regulator for airport security, the Secretary of State for Transport has contact with the full range of security stakeholders operating at the airport, including the police. The Secretary of State for Transport’s remit for aviation security extends to the United Kingdom as a whole, mirroring the application of these provisions. The Home Secretary’s remit for general policing does not extend to Scotland or Northern Ireland. Given these factors, we believe the Secretary of State with responsibility for aviation security as a whole is the most appropriate person to refer disputes to, rather than a Secretary of State who has a more narrow focus in this context.
However, it is important to clarify—I am happy to answer the noble Baroness’s point—that the Home Secretary may well have significant interests in security at the airport, particularly with regards to policing or the functions, for example, of the UK Border Agency. When this is the case, we fully expect that the Home Secretary would be consulted. The dispute resolution provisions already enable this by providing broad powers for the Secretary of State to decide procedures based on the nature and complexity of the matter. Similarly, if it were ever the case that the dispute was to be determined by the Home Secretary, we would expect the Secretary of State responsible for aviation security to be consulted, when appropriate. We have considered this dispute process in consultation with others, and both the Association of Chief Police Officers and industry support the approach taken in the Bill. I hope this provides the Committee with some reassurance.
Amendment 152AX would require disputes about the content of a police services agreement or the costs of policing to be referred to the Home Secretary before the requirement to produce a police services agreement had been established. Clause 77 prescribes the requirement for an airport security plan, containing a holistic range of security measures. If dedicated policing services are identified in an airport security plan, only then is there a requirement to draw up a police services agreement as set out in Schedule 6. The amendment pre-empts disputes over policing and police services agreements in a clause which is essentially about the preceding stages of the security planning process.
Amendments 152AZ and 152BA raise the importance of ensuring that disputes, whether about the contents of an airport security plan or a police services agreement, do not drag on unnecessarily. We agree that there is very little to be gained from allowing such a situation to develop. Disputes need to be handled in a timely and effective manner. What we would question, however, is the inclusion of a mandatory cut-off period for the handling of disputes, which are likely to vary considerably in length, depending on the nature of the issue itself and the complexity of operations at the airport concerned. On the one hand, it may be that a determination need only resolve a dispute about a single security measure. At the other end of the scale, although it is unlikely, a determination could, require a full consideration of final policing levels at an airport, needing a complete reassessment of the airport security plan and police services agreement. This process could also involve, for example, an inspection carried out by an external party, such as Her Majesty’s Inspectorate of Constabulary. At one end of the scale, three months might actually represent too long a period to determine a dispute, while, at the other, it could well be insufficient.
It is precisely because of the fact that disputes are likely to be very different that the Bill provides the Secretary of State with broad powers to determine a dispute in a manner he considers to be most suitable. Although the Secretary of State’s primary concern will be to ensure that an effective and fair determination is provided, the importance of ensuring that a determination is provided within a reasonable timeframe is also something of which he may be mindful. The Secretary of State may be able to provide an indicative timetable to parties at the start of a dispute once an assessment of the complexity of the dispute is made, to provide the parties with some level of certainty so as to assist budgetary considerations, for example. However, I caution that this will be dependent on the individual facts of each dispute.
It is worth noting that, when parties have been unable to agree a police services agreement and may be in breach of a requirement to have one in place, the airport operator will still be required to make payments in respect of the interim policing services being provided at the airport. The Secretary of State’s determination, once made, can require repayment to the airport operator by the police if that is judged to be fair in light of payments made to the police during this interim period. Thus the Bill ensures that there is no financial incentive for an operator to seek to prolong disputes indefinitely.
In light of the assurances I have offered I hope that my noble friend will feel able to withdraw his amendment.
Lord Harris of Haringey: My Lords, I am grateful to my noble friend for those responses. I was less clear at the end of the first part of his response than I was at the beginning as to how exactly he envisaged the arrangements working between the various Secretaries of State. What I hope is that, in whatever guidance emerges, there can be clarity about the important nature of security within all this. I would not want to see a position in which commercial issues overrode the situation. However, I understand what the noble Lord, Lord Bradshaw, and others highlighted about the importance of clarity on what security means and enabling that to be assessed independently by those able to take a step back from it. That is what I envisage the Secretary of State’s role will be. I am grateful that we may be able to look at these matters. Any indication that my noble friend can give before Report as to the nature of the guidance to be issued would be extremely welcome.
As for time limits, I understand that there will be different sorts of circumstances and welcome the fact that there will be circumstances in which an airport operator may be required to pay money from the period from which arbitration takes place. However, I was slightly confused by the language that my noble friend used. He said that the Secretary of State may consider whether the time limit would be reasonable. I may have misheard what he said, but the implication was that it would be up to the Secretary of State to decide whether to operate within a reasonable timescale. I am sure that that is not what he intended, but could there be clarity in the guidance to make it explicit that the Secretary of State is required to act in a timely manner and that, potentially, if it were felt that he was operating too slowly, it would be a matter subject to judicial review. On the basis that that is what my noble friend meant, I beg leave to withdraw the amendment.
Amendment 152AV withdrawn.
Amendments 152AW and 152AX not moved.”
It is now 11.10pm and the House is still sitting and still debating amendments to the Policing and Crime Bill.
Consecutive days’ editions of the Evening Standard have highlighted a split in the Tory party on airport policy in London.
Yesterday, the Tories said no more runways for London airports. Indeed, a manifesto commitment was promised to scrap plans for a third runway at Heathrow with an added pledge that there would be no expansion at Gatwick or Stansted.
This sparked cynical remarks that (perish the thought) the Conservatives were eying Labour-held marginals on the Heathrow flightpath.
Today, we hear (from the same reporter) that, in fact, billions of pounds have been pledged by oil-rich countries and China to build a brand-new additional airport in the Thames Estuary.
I understand there are no relevant marginals in the flightpath of the proposed new airport.
So yesterday’s arguments were nothing about climate change or high principle: it was just about votes.
The Parliament Education Service runs an annual Discover Parliament Programme aimed at 16-18 year olds studying higher level politics, citizenship and general studies. This afternoon I met 80 students taking part in the Programme. They were from three schools in Pinner, Chelmsford and Bristol.
As ever on such occasions, the questioning was lively, sometimes challenging and extremely wide-ranging. We covered – amongst other things – such topics as:
As I said, a lively hour – and an exhilarating one too.
Effectively, these Discover Parliament programmes can only take place during school term time and when Parliament is not sitting. In practice that means they are only possible for about four weeks a year from the early part of September. A by-product of Speaker John Bercow’s proposal to shorten Parliament’s summer recess might well be to end these programmes. Whatever the merits or otherwise of Parliament sitting in September (something I personally would favour), it would be a retrograde step to lose this outreach work with young people.
I spent an interesting hour or so this afternoon with a “white hat hacker” – someone who uses his substantial computing experience to identify system weaknesses and vulnerabilities so that those weaknesses and vulnerabilities can be fixed.
He demonstrated how simple it is to clone most so-called smart cards, so as to render many (virtually all) secure entry systems redundant. The technology is readily available as are the programmes required to do it.
This doesn’t mean that card-based systems are of no value, but what it showed was how often there are basic design flaws that could be fixed, so as to render such systems much harder to compromise.
I had missed the reports of the Dutch researchers who were able to put phantom money onto their Oyster cards so as to travel round London free. This afternoon, I saw how easily it can be done by those who are minded to cheat the system. I wonder how much Transport for London are losing by this weakness each day and whether their systems for detecting such fraud and de-activating the cards concerned are as robust as they claim.
At the end of 2005, I persuaded three reputable “white hat” penetration testing companies to offer their services for free to any Government department that would like some independent checking of their information security. I wrote with this offer to the designated “senior information risk owner” in every Ministry. The three companies were worried that they would be put out of business by the rush of Government agencies taking them up on their generous offer. However, you will not be surprised to learn that after seven weeks not a single one of the twenty or so “senior information risk owners” that I had written to had replied. I then got a letter from the Cabinet Office on behalf of all of them – an example of coordinated Government rarely seen before or since – declining and saying that they were confident that their systems for protecting information were more than sufficient and that no external validation was needed. Subsequent experience showed how complacent that response was.
This afternoon’s meeting suggested that similar complacency still all too often reigns – not only in the public sector but in the private sector as well. Of course, there are exceptions and I have come across examples of excellent practise with systems checked by two external penetration testing companies, independent of those who have supplied, installed or manage the systems concerned. However, those examples are just that – exceptions. Too often senior managers don’t understand the problem or the risks that they face and are too readily reassured by those who have a vested interest in saying that everything is fine.