Police forces not fully prepared for the ‘significant’’ threat from cyber attacks

The warning comes in a new report from His Majesty’s Inspectorate of Constabulary and Fire and Rescue Services (HMICFRS), which said opportunities to strengthen cybersecurity arrangements “cannot be missed” and leaders must prioritise and invest in them.

The report highlights that cybersecurity risks in the UK and globally are “increasing in scale, complexity and impact” and there is an urgent need to protect systems from the threat.

His Majesty’s Inspector of Constabulary Michelle Skeer OBE QPM said: “The cyber threat to police forces and fire and rescue services is significant and expanding rapidly. A major cyberattack is not a hypothetical scenario and successful attacks have been disruptive, put the public at risk and were expensive to fix.

“While there have been gradual improvements, many forces and services still need to urgently redouble their efforts to respond to the increased risk of cyberattacks. Cybersecurity should be viewed as a core organisational priority and not solely a technical risk. Leaders need to prioritise and invest in their cybersecurity arrangements to improve their organisation’s ability to prevent, detect, respond to and recover from attacks.”

She added: “The Government’s programme of police reform and local government reorganisation could offer both sectors opportunities to improve and better coordinate the approach to cybersecurity. These opportunities to strengthen cybersecurity cannot be missed. Protecting systems and data is essential to protecting the public.”

While the inspectorate found committed and capable personnel working hard to keep systems secure, as well as some gradual improvement in cybersecurity arrangements across both sectors, many forces and services still have “much work to do” to address recurring areas of weakness.

Inspectors also found that modernising ICT across both sectors must become a priority to improve resilience. All the organisations inspected rely on legacy systems to some extent, with leaders identifying these systems as their highest strategic risk for cybersecurity.

The inspectorate also raised concerns about cybersecurity risks linked to third-party ICT suppliers, particularly where suppliers store or manage sensitive police data. The way staff use ICT systems and data was also a significant problem, with some forces and services simply not doing enough to prevent human error from increasing the risk of cyberattacks, it said.

Inspectors also found that preparedness and resilience arrangements were often underdeveloped, with unsatisfactory arrangements for backing up and restoring ICT systems following a cyberattack.

“Forces and services are improving their ability to monitor their ICT systems and detect cyberattacks. But, in many cases, there isn’t enough monitoring coverage or capability,” HMICFRS said.

The inspectorate said a leadership issue is underpinning these problems: “Several senior police and fire leaders said they did not consider cybersecurity to be part of daily operational decision-making, which means investment is being directed to other priorities.”

Chris Cope, National Chief Information Security Officer at the Police Digital Service, said the report was a “timely reminder of both the progress policing has made and the challenges that remain”.

“Cyber threats continue to evolve and present a growing risk to policing and public safety,” he said.

“We welcome the findings of this HMICFRS report, which recognise the important role of national cyber capabilities, including the Police Digital Service’s National Management Centre, security assurance for policing, and cyber assurance work.

“While policing has made significant progress, the report makes clear there is more to do. We will continue working closely with the NPCC, forces, government and industry partners to strengthen cyber resilience, improve national coordination and help policing defend as one against emerging threats.”

HMICFRS has made 13 recommendations intended to strengthen cybersecurity, including:

• Making sure all forces and services achieve baseline standards for cybersecurity capabilities;
• Introducing robust external validation of services’ assessments of cybersecurity capabilities;
• Improving the procurement and contract management of third-party ICT suppliers;
• Enhancing collaborative arrangements between government and policing cybersecurity leads;
• Promoting the use of the Police Digital Service’s National Management Centre, and creating a similar national capability for services;
• Increasing the preparedness of services to respond to a cyberattack; and
• Better supporting learning and development for senior leaders and cybersecurity staff.