Request for information - Ref No: FOI221061
Request
Thank you for your email of 17 October 2022, requesting information from Ordnance Survey in accordance with the Freedom of Information Act (FOIA) 2000, as set out in the extract below:
“Please provide me with the total number of malicious emails blocked by your organisation over the last three calendar years (2021, 2020, 2019) broken down by year and categorised accordingly.”
Our response
I confirm that Ordnance Survey only holds a record of blocked email for a period of 90 days, therefore, we do not hold the information you have requested, other than for the last 90 days.
However, we are unable to comply with your request and provide the figures for the last 90 days; as we are continually reviewing our security profile, and now consider the information you have requested to be exempt from disclosure under section 31(1)(a) of the FOIA, as explained below.
Section 31(1)(a) the prevention or detection of crime
Section 31(1)(a) exempts information if its disclosure would or would be likely to prejudice the prevention and detection of crime. In this case, we consider that disclosure of the information would be likely to make OS more vulnerable to crime, namely a malicious attack on our security and computer systems.
Disclosure of the information would comprise measures to protect our security and computer systems, jeopardising our computer and security systems, by leaving us vulnerable to attack. It would be likely to assist someone in determining the level of effectiveness of detecting and defending against such attacks, and would be likely to assist a determined attacker, by allowing them to evaluate any vulnerabilities which may or may not exist. We consider that disclosure of this type of insight into our computer and security systems, would create a real and significant risk to our computer and security systems.
This is a qualified exemption, and we are required to consider the public interest.
Public Interest Test
OS recognises the need for transparency; and that there is a public interest in knowing that OS has measures in place to prevent against such attacks and protect information; however, disclosure of this information would mean our computer and security systems would be more vulnerable to malicious attacks, therefore facilitating the possibility of crime.
Section 31(1)(a) is a prejudice-based exemption, and there is a public interest inherent in avoiding the harm specified. OS considers that the prejudice would be likely to occur, and we are satisfied there is a greater public interest in protecting our computer and security systems by withholding the information under this exemption.
Internal review
Your enquiry has been processed according to the Freedom of Information Act (FOIA) 2000. If you are unhappy with our response, you may request an internal review with our Internal Review Officer by contacting them, within two months of receipt of our final response to your Freedom of Information (FOI) request, as follows:
Internal Review Officer
Customer Service Centre
Ordnance Survey
Adanac Drive
Southampton
SO16 0AS
Please include the reference number above. You may request an internal review where you believe Ordnance Survey has:
- Failed to respond to your request within the time limits (normally 20 working days)
- Failed to tell you whether or not we hold the information
- Failed to provide the information you have requested
- Failed to explain the reasons for refusing a request
- Failed to correctly apply an exemption or exception
The Internal Review Officer will not have been involved in the original decision. They will conduct an independent internal review and will inform you of the outcome of the review normally within 20 working days, but exceptionally within 40 working days, in line with the Information Commissioner’s guidance.
The Internal Review Officer will either: uphold the original decision, provide an additional explanation of the exemption/s applied or release further information, if it is considered appropriate to do so.
Appeal to Information Commissioner’s Office (ICO)
If, following the outcome of the internal review you remain unhappy with our response, you may raise an appeal, within three months of receiving our response, with the Information Commissioner’s Office.
Further information can be found on the ICO website (ico.org.uk) under ‘Report a concern’ or you may wish to call the ICO helpline on 0303 123 1113.