FOI request (FOIR-359999996)

Ransomware

Requested Wed 01 September 2021
Responded Thu 09 September 2021

Please can you answer the following questions.

A. In the past three years has your organisation:

1. Had any ransomware incidents? (An incident where an attacker attempted to, or successfully, encrypted a computing device within your organisation with the aim of extorting a payment or action in order to decrypt the device.)

If yes, how many?

2. Had any data rendered permanently inaccessible by a ransomware incident? (that is, some data was not able to be restored from back up.)

3. Had any data rendered permanently inaccessible by a systems or equipment failure? (that is, some data was not able to be restored from back up.)

4. Paid a ransom due to a ransomware incident / to obtain a decryption key or tool?

If yes was the decryption successful, with all files recovered?

5. Used a free decryption key or tool? (for example, from https://www.nomoreransom.org/)

If yes was the decryption successful, with all files recovered?

6. Had a formal policy on ransomware payment?

If yes please provide, or link, to all versions relevant to the 3 year period.

7. Held meetings where policy on paying ransomware was discussed?

8. Paid consultancy fees for malware, ransomware, or system intrusion investigation?

If yes at what cost in each year?

9. Used existing support contracts for malware, ransomware, or system intrusion investigation?

10. Requested central government support for malware, ransomware, or system intrusion investigation?

11. Paid for data recovery services?

If yes at what cost in each year?

12. Used existing contracts for data recovery services?

13. Replaced IT infrastructure such as servers that have been compromised by malware?

If yes at what cost in each year?

14. Replaced IT endpoints such as PCs, Laptops, Mobile devices that have been compromised by malware?

If yes at what cost in each year?

15. Lost data due to portable electronic devices being mislaid, lost or destroyed?

If yes how many incidents in each year?

B. Does your organisation use a cloud based office suite system such as Google Workspace (Formerly G Suite) or Microsoft's Office 365?

If yes is this system's data independently backed up, separately from that platform's own tools?

C. Is an offsite data back-up a system in place for the following? (Offsite backup is the replication of the data to a server which is separated geographically from the system's normal operating location site.)

a. Mobile devices such as phones and tablet computers

b. Desktop and laptop computers

c. Virtual desktops

d. Servers on premise

e. Co-located or hosted servers

f. Cloud hosted servers

g. Virtual machines

h. Data in SaaS applications

i. ERP / finance system

D. Are the services in question C backed up by a single system or are multiple systems used?

E. Do you have a cloud migration strategy? If so is there specific budget allocated to this?

F. How many Software as a Services (SaaS) applications are in place within your organisation?

How many have been adopted since January 2020?

Response

Notice of Refusal

Disclosure of information relating to ICT infrastructure and security constitutes a security risk as it would leave the Council's computer assets more vulnerable to a malicious hacking attack. This means that disclosure would:

• Make the Council more vulnerable to crime (Section 31)

• Risk harming the systems on which the day-to-day business of the Council relies (Section 43)

Section 31 (Law Enforcement)

Section 31(1)(a) states that information is exempt if its disclosure is likely to prejudice the prevention or detection of crime. ICO guidance states that this can be used to protect information on a public authority's systems which would make it more vulnerable to crime. This exemption can be used by a public authority that has no law enforcement function:

• To protect the work of one that does

• To withhold information that would make anyone, including the public authority itself, more vulnerable to crime

The crime in question would be a malicious attack on the Council's computer systems. Since the disclosure of the withheld information would make the Council's systems more vulnerable to such crime, the exemption is engaged.

The exemption is subject to the public interest test. There is an overwhelming public interest in keeping the Council's computer systems secure which would be served by non-disclosure. This outweighs the public interest in accountability and transparency that would be served by disclosure.

Section 43 (Commercial Interests)

Section 43(2) states that information is exempt if its disclosure would, or would be likely to, prejudice the commercial interests of any person (including the public authority holding it).

Disclosure of information relating to ICT security puts the council at risk of a malicious hacking attack. This would compromise the Council's ability to provide its services and carry out 'business-as-usual' should our systems be compromised. Were our systems to be compromised, the cost of a system recovery would be detrimental to the Council's commercial interests.

The exemption is subject to the public interest test. There is an overwhelming public interest in keeping the Council's computer systems secure which would be served by non-disclosure. This outweighs the public interest in accountability and transparency that would be served by disclosure.