FOI 177 / Feb 2023 / Telephone & Microsoft contracts
FREEDOM OF INFORMATION REQUEST REFERENCE NO: 177-2023
I write in connection with your request for information which was received on 10th February 2023. Please find the Warwickshire Police response set out below.
- Telephony and UC/ Collaboration
- Please confirm the manufacturer of your telephony system(s) that are currently in place
Q1a response: Avaya
- When is your contract renewal date?
Q1b response: Currently expires 16 March 2025
- Who maintains your telephony system(s)?
Q1c response: NEC Software Solutions UK Ltd
- Do you use Unified Communications or Collaboration tools, if so which ones?
Q1d response: No
- Microsoft
- a) What Microsoft 365 licence do you have across the business e.g. E3, E5
Q2a response: E3
- b) Which partner looks after your Microsoft tenant?
Q2b response: We do not use a CSP
- c) Where do you host your applications? Do you have on-premise infrastructure or do you host your applications in public or private cloud? Which?
Q2c response: Both
- Storage
- Does your organisation use on-premise or cloud storage or both?
Q3a response: Both
- Please confirm the on-premise hardware manufacturer
- Please confirm your cloud storage provider
Q3b & Q3c response: Section 1 of the Freedom of Information Act 2000 places two duties on public authorities. Unless exemptions apply, the first duty at section 1(1)(a) is to confirm or deny whether the information specified in a request is held. The second duty at, section 1(1)(b), is to disclose information that has been confirmed as being held.
Where exemptions are relied upon section 17 of the Freedom of Information Act 2000 requires Warwickshire Police, when refusing to provide such information (because the information is exempt) to you the applicant with a notice which:
(a) states that fact,
(b) specifies the exemption in question and
(c) states (if that would not otherwise be apparent) why the exemption applies.
The exemptions applicable to the information are:
Section 24(1) - National Security
Section 31(1) - Law Enforcement
Sections 24 and 31 are prejudice based qualified exemptions which require both evidence of harm and public interest considerations to be articulated to the applicant. Please find these set out below.
Harm
In considering disclosure it must be taken into account the fact that release of information under the FOIA is to ‘the whole world’ and not just to an individual applicant. It is therefore necessary to consider the effect of releasing the information into the public domain.
Disclosure of the on-premise hardware manufacturer and cloud storage provider has the potential to undermine law enforcement and threaten national security by providing an awareness of exactly what is used by individual forces. Release of this information would highlight to hackers intent on carrying out cyber-attacks on police systems, potential vulnerabilities which would ultimately allow them to evade or circumvent detection.
Public Interest Considerations
Section 24 - Factors favouring disclosure
The public are entitled to know how public funds are spent and how resources are distributed within an area of policing.
Section 24 - Factors against disclosure
If Warwickshire Police were to fall victim to hackers, the implications would affect the country on a national scale and therefore could adversely affect national security as well as undermine policing.
Police information, intelligence and tactics could be obtained, resulting in the criminal fraternity, including terrorists, gaining knowledge that will assist in the planning of offences and evading detection. Any incident that results from such a disclosure would, by default, affect National Security.
Section 31 - Factors favouring disclosure
Disclosing information relevant to this request would lead to a better informed public.
Section 31 - Factors against disclosure
Disclosure of such information would suggest Warwickshire Police take their responsibility to protect information and information systems from unauthorised access, destruction, etc., dismissively and inappropriately. The release of this type of information would better inform a criminal intent on launching a cyber-attack against the police. If a force was hacked and this lead to their IT systems not working efficiently then this would have a negative impact upon the prevention and detection of crime.
Balancing Test
The points above highlight the merits for and against disclosure of the requested information.
The public entrust the Police Service to make appropriate decisions with regard to their safety and protection and the only way of reducing risk is to be cautious with what is placed into the public domain.
Disclosure would undoubtedly provide greater openness, and whilst there is always a public interest in the transparency of how the police service deliver effective law enforcement and protect national security, there is a very strong public interest in safeguarding information contained in IT systems.
The Police Service is charged with enforcing the law, preventing and detecting crime and protecting the communities we serve. As part of that policing purpose, information is gathered which can be highly sensitive relating to high profile investigative activity. Weakening the protection of such information would place the security of the country at an increased risk and compromise law enforcement. In addition, anything that places the confidence in the police service at risk, no matter how generic, would undermine public trust and confidence.
Therefore, at this moment in time, it is our opinion that for these issues the balance test favours withholding this information.
This serves as a refusal notice under Section 17 of the Freedom of Information Act in relation to these elements of your request.
- What is your annual spend on cloud storage?
Q3d response: Approx £150k
- How do you back up your data and with who e.g. Backup as a Service
Q3e response: MSP – Risual
Every effort has been made to ensure that the information provided is as accurate as possible.
Your attention is drawn to the below which details your right of complaint.
Should you have any further enquiries concerning this matter, please write or email the Freedom of Information Unit quoting the reference number above.
Yours sincerely
Freedom of Information Officer
Freedom of Information Unit
Warwickshire Police
PO Box 4
Leek Wootton
Warwickshire
CV35 7QB