Ransomware - 627/16
Dated: 02 Jun 2016
Provision of information held by Northumbria Police made under the Freedom of Information Act 2000 (the 'Act')
Thank you for your e mail dated 18 May 2016 in which you made a request for access to certain information which may be held by Northumbria Police.
As you may be aware the purpose of the Act is to allow a general right of access to information held at the time of a request, by a Public Authority (including the Police), subject to certain limitations and exemptions.
Please may I request answers to the following questions:
1. Whether the force has fallen victim to a ransomware virus scam (a definition of which can be found at: http://www.trendmicro.com/vinfo/us/security/definition/ransomware), or has been made aware that it has transmitted a ransomware virus scan from its email server, between 1 January 2014 and 18 May 2016 inclusive, in whichever format is easiest to supply; and
2. If the answer to question 1) is "yes", whether the force paid the ransom, and if so, how much it paid in pounds sterling, in whichever format is easiest to supply.
We have now had the opportunity to fully consider your request and I provide a response for your attention.
Following receipt of your request, searches were conducted with the ICT Department of Northumbria Police. I can confirm that the information you have requested is held by Northumbria Police.
I am able to disclose the located information to you as follows.
Additionally Northumbria Police can neither confirm nor deny that they hold any other information relevant to the whole of your request by virtue of the following exemption.
Section 23(5) Information supplied by, or concerning, certain security bodies.
The duty to confirm or deny does not arise if, or to the extent that, compliance with Section 1(1)(a) would involve the disclosure of any information (whether or not already recorded) which was directly or indirectly supplied to the public authority by, or relates to, any of the bodies specified in subsection (3)
This is an absolute exemption and I am therefore not required to complete a public interest test.
Due to the different methods of recording information across 43 forces, a specific response from one constabulary should not be seen as an indication of what information could be supplied (within cost) by another. Systems used for recording these figures are not generic, nor are the procedures used locally in capturing the data. For this reason responses between forces may differ, and should not be used for comparative purposes.
The information we have supplied to you is likely to contain intellectual property rights of Northumbria Police. Your use of the information must be strictly in accordance with the Copyright Designs and Patents Act 1988 (as amended) or such other applicable legislation. In particular, you must not re-use this information for any commercial purpose.