PSNI data leak leads to Chief resignation and arrests

The worst-ever data leak at the Police Service of Northern Ireland (PSNI) has resulted in Chief Constable Simon Byrne’s resignation and two additional arrests linked to the incident.

Byrne resigned with immediate effect after losing a vote of no confidence from the Democratic Unionist Party (DUP).

Policing Board members accepted his resignation which arrived four years after his appointment to Northern Ireland’s top policing role. The board will consider leadership arrangements going forward.

”Regardless of the rights and wrongs, it is now time for someone new to lead this proud and resolute organisation,” said Deirdre Toner in a statement on behalf of the former PSNI Chief Constable.

Byrne called the data leak an ‘unprecedented crisis’ and expressed deep regret for the industrial-scale breach of data that had gone into the public domain via a response to a Freedom of Information request.

Along with the data leak, pressure for Byrne to resign also mounted after the unlawful disciplining of two junior officers.

Arrests made in connection to data leak

On 2 September, two men were arrested under the Terrorism Act related to the data leak. The men, aged 21 and 22, were released on bail.

Detective Chief Superintendent Andy Hill said the PSNI working toward ‘establishing those who possess information relating to the data breach’.

In total, four arrests were made in relation to the data leak.

On 16 August, a 39-year-old was reportedly arrested on suspicion of collection of information likely to be useful to terrorists. He was later released on bail.

A 50-year-old man was arrested on 18 August, charged with terrorism offences. He appeared in court on 21 August and was remanded in custody for four weeks.

How did the PSNI data leak happen?

A spreadsheet containing extensive PSNI staff data, including names, ranks, and other details, was accidentally published online for over two hours before being removed.

In total, there were multiple entries relating to 10,799 individuals. Each individual had up to 32 pieces of data relating to them, equalling approximately 345,000 entries.

It originated from a Freedom of Information request seeking officer and staff breakdowns. The exact query was ‘Could you provide the number of officers at each rank and number of staff at each grade?’.

The incident prompted PSNI to investigate a second data breach involving the theft of a spreadsheet with over 200 officers’ names, along with a police laptop and radio, from a vehicle in Belfast.

Police have confirmed the list is in the hands of dissident republicans, amongst others. It is not yet clear to what extent the spreadsheet was accessed and shared, and by whom.

How will the data leak be investigated?

Jointly commissioned by the Northern Ireland Policing Board (NIPB) and the PSNI, an independent review is currently in progress to evaluate the incident.

The review’s goal is to investigate the circumstances of the breach, identify any action required to build more robust systems, and restore confidence in the organisation’s approach to information security.

Phase 1 will end on 8 September. The outcomes will inform the Review Plan to deliver the objectives agreed as part of Phase 2. Phase 2 is expected to be completed by 30 November 2023.

The Information Commissioner’s Office (ICO) has been informed about the incident, which could deal out fines and penalties.

Hungry for more tech news?

Sign up for your weekly tech briefings!