The Police Service of Northern Ireland (PSNI) has apologised after information about all of the force’s serving officers and staff was published in a data breach.
At a press conference in Belfast, PSNI Assistant Chief Constable Chris Todd said the surname, initial, the rank or grade, the location and the departments of all current officers had been accidentally published in response to a Freedom of Information (FOI) request.
The Belfast Telegraph first reported that a spreadsheet was published online relating to how many officers the PSNI has of each rank, but that the spreadsheet had a second tab that contained more detailed information about thousands of staff members and their employment.
It says that this information was mistakenly posted online for a period of time.
Todd said: “In terms of the security for individuals, there’s nothing at the moment to suggest there’s any immediate security concerns, but we have put actions in place to ensure that if anything does arise we will be aware of that, and then we can mitigate accordingly.”
He added: “This is human error.
“We’ve looked into the circumstances, we’ll continue with our investigation, but the very early considerations are that this is simple human error and the people who have been involved in the process have acted in good faith.
“We’ve identified some steps that we can take to ensure that it doesn’t happen again.
“It is regrettable but it is simple human error.”
Todd also said the severe terrorist threat facing PSNI officers has made news of the extensive data breach “the last thing that anybody in the organisation wants to be hearing”.
Mike Nesbitt, the Ulster Unionist representative on the Policing Board of Northern Ireland, called for an emergency meeting of the Policing Board on Wednesday in response to the disclosure.
Nesbitt said it must be seen the breach is being taken seriously by the police.
He added: “It is imperative that officers, staff and their families and friends understand how seriously this breach is being taken, and that the board is determined to fulfil its oversight and challenge functions appropriately,” he said.
“There are several issues here. First, ensuring those who now feel themselves at risk are given a realistic assessment of the implications of the data breach.
“Second, why was there no ‘fail safe’ mechanism to prevent this information being uploaded.
“Third, there is the question of whether it was a genuine mistake and, here, the principle of innocent until proven guilty applies.
“I view this like a serious incident when people are seriously physically injured. The priority is to assist the injured. Only after that do you turn to examine the other issues.
“In other words, my thoughts are with those whose names have been released into the public domain, who had a reasonable expectation this would never happen.”
Alliance Party leader and former Justice Minister Naomi Long said that the scale of the data breach was of “profound concern”.
Liam Kelly, chair of the Police Federation for Northern Ireland (PFNI), described the breach as “monumental”.
Kelly said an urgent inquiry is required and that members of the PFNI are “appalled”.
“This is a breach of monumental proportions. Even if it was done accidentally, it still represents a data and security breach that should never have happened,” he said.
“Rigorous safeguards ought to have been in place to protect this valuable information which, if in the wrong hands, could do incalculable damage.
“The men and women I represent are appalled by this breach. They are shocked, dismayed and justifiably angry. Like me, they are demanding action to address this unprecedented disclosure of sensitive information.
“We have many colleagues who do everything possible to protect their police roles. We’re fortunate that the PSNI spreadsheet didn’t contain officer and staff home addresses, otherwise we would be facing a potentially calamitous situation.
“Inadequate or poor oversight of FOI procedures must be addressed and addressed urgently. New safeguards are obviously required to prevent this from ever happening again.”
The Information Commissioner’s Office (ICO) has been notified about the incident.
An ICO spokesman said: “The Police Service of Northern Ireland has made us aware of an incident and we are assessing the information provided.”
