Correspondence with Scottish Environment Protection Agency (SEPA) relating to cyber-attack: FOI release

Information requested

For all correspondence between Scottish Ministers and the SEPA senior management team that relates to the Christmas 2020 cyberattack. To include sms, WhatsApp, Signal and other messages, and briefings received by ministers, dated from the date the hack started to 31st March 2021.

Response

Attached is a copy of some of the requested information. 

Exemptions under sections 30(c), 38(1)(b) and 35(1)(a) of FOISA applies to some of the information you have requested which has been redacted.

An exemption under section 30(c) of FOISA (prejudice to effective conduct of public affairs) applies to some of the information requested. It is essential for Ministers to be able to communicate, often in confidence, with external stakeholders on a range of issues . Disclosing the content of these communications, particularly without the consent of the stakeholder, is likely to undermine their trust in the Scottish Government and will substantially inhibit communications on this type of issue in the future. These stakeholders will be reluctant to provide their views fully and frankly if they believe that their views are likely to be made public, particularly while these discussions relate to a sensitive or controversial issue such as a cyber-attack. This would significantly harm the Government’s ability to carry out many aspects of its work, and could adversely affect its ability to gather all of the evidence it needs to make fully informed decisions. This exemption is subject to the ‘public interest test’. Therefore, taking account of all the circumstances of this case, we have considered if the public interest in disclosing the information outweighs the public interest in applying the exemption. We have found that, on balance, the public interest lies in favour of upholding the exemption. We recognise that there is a public interest in disclosing information as part of open, transparent and accountable government, and to inform public debate. However, there is a greater public interest in allowing Ministers and officials a private space within which to communicate with appropriate external stakeholders as part of the process of exploring and refining the Government’s position on, until the Government as a whole can adopt a decision that is sound and likely to be effective. This private space is essential to enable all options to be properly considered, so that good decisions can be taken based on fully informed advice and evidence. Premature disclosure is likely to undermine the full and frank discussion of issues between the Scottish Government and these stakeholders, which in turn will undermine the quality of the decision making process, which would not be in the public interest.

An exemption under section 38(1)(b) of FOISA (personal information) applies to a small amount of the information requested because it is personal data of a third party, and disclosing it would contravene the data protection principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act 2018. This exemption is not subject to the ‘public interest test’, so we are not required to consider if the public interest in disclosing the information outweighs the public interest in applying the exemption.

An exemption under section 35(1)(a) of FOISA (prevention or detection of crime) applies to some of the information requested. This exemption applies because disclosure of this particular information would, or would be likely to, prejudice substantially ongoing police investigations. This exemption is subject to the ‘public interest test’. Therefore, taking account of all the circumstances of this case, we have considered if the public interest in disclosing the information outweighs the public interest in applying the exemption. We have found that, on balance, the public interest lies in favour of upholding the exemption. We recognise that there is a public interest in disclosing information as part of open and transparent government. However, there is a greater public interest in protecting the ongoing police investigations.

About FOI
The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at http://www.gov.scot/foi-responses.

FOI202100202192 - Information released

File type

25 page PDF

File size

1.1 MB