Police Service of Northern Ireland’s dangerous error

The release of the personal details of police officers in Northern Ireland could hardly be a more serious data breach. It appears to have been the result of a freedom of information request seeking nothing more consequential than the overall complement of the Police Service of Northern Ireland (PSNI) and the numbers in each rank. 

Clearly, the publication of the names, ranks, locations and other personal data of every serving police officer and civilian employee was a mistake. It also included the location where they are based (but not their home address), details of their unit, their branch and department. It even identified PSNI staff based with MI5. 

How this came about is being investigated within the PSNI and by the Information Commissioner. But the likelihood that it was accidental and the information was taken down from the internet within a few hours does not obviate the need for someone to be held accountable. 

The PSNI said the fault lay in a “human error” involving spreadsheet fields. But we need to know how this data was kept, why it was not encrypted, and how it could so easily have been wrongly attached to the data being made public. More to the point, was this an exercise passed over to a junior staff member with no proper supervision? 

Senior officers said the breach would not compromise the security of officers but, even 20 years after the Good Friday Agreement, there are people who could use the information to settle old scores or even current ones. 

Assistant Chief Constable Chris Todd said the error was unacceptable. If so, someone senior needs to take responsibility and resign.