All information below which was leaked by ICO and DCMS was posted publicly to whatdotheyknow.com before republication here.
2022/11/02 – ICO accidentally leaks DCMS denials:
One document which I have not included (ICO2022_13484 – Official Sensitive: Questions about Nominet – Remain exempt under S41) is an email chain that was exempt from release under Section 41(1). I have not attached this document due to the argument below in point 1, however, if you need to see this, then please let me know. I can confirm that the third party in question in this case is Nominet UK. Our reasons for exempting the above mentioned information under Section 41(1) are as follows:
This chain covers communication between DCMS officials and Nominet regarding a DCMS review of internet Critical National Infrastructure. Essentially, the point of the review was to identify the most critical UK infrastructure, which if lost, damaged or disrupted would cause the most significant damage to the UK. There are 3 key reasons for withholding this chain from release:
Freedom of Information Team – Department for Digital, Culture, Media and Sport – ICO2022 13484.pdf
- Even acknowledging that we were speaking with Nominet about this issue would give away the fact that they are critical to UK national security. Allowing this to enter the public domain could raise the profile of how important Nominet is, drawing the attention of our adversaries. Given the sensitivity, there is a legitimate question here about whether ICO should see this.
- The specific information in this email covers potential critical national infrastructure systems. The level of data aggregation in this chain is towards the top end of OFFICIAL SENSITIVE, but if the chain is to be released, then significant redaction would be required.
- The information provided by Nominet was in confidence and is commercially sensitive. We need to continue to work with Nominet to ensure their critical systems are secure and resilient, which would rely on our ability to communicate openly.
2022/11/02 – DCMS accidentally leaks emails between itself and Nominet from Feb/March 2022:
../assets/wp-content/uploads/2023/08/ICO2022-13484-Released-information-unredacted-2.pdf
2022/11/02 – DCMS accidentally leaks emails between itself and Nominet from Feb/March 2022:
Christopher Eddy – Freedom of Information Team DCMS – Ministerial Support Team 4th Floor, 100 Parliament Street, London SW1A 2BQ
2022/11/02 – DCMS accidentally leaks emails between itself and Nominet from March 2022:
2022/11/14 – ICO leaks DCMS email about Nominet being CNI or not:
Hi Jonathan,
Please find attached the document we exempt under section 41 [not supplied to me]. Please also find policy’s counter arguments below:
On withholding the subject matter of the email
There is an important difference between an organisation declaring itself as CNI and the UK government confirming that an organisation operates CNI. Our position in this space is to ‘neither confirm, nor deny’ whether individual systems or operators were CNI. Making it public that DCMS are speaking with Nominet about CNI, suggests that we either consider them CNI or potential CNI. ***We recently asked Nominet to reconsider the wording on their website to remove references to them being CNI.***
On the question about how we knew the information provided was in confidence and commercially sensitive
It is a standard practice when gathering information about the operation of an organisation’s most critical systems that we should protect that information from wider release. A verbal assurance was given on a call at the time that all information provided would of course be treated in confidence.
It is implicit that any information regarding the operation of an organisation’s most critical systems would be commercially sensitive and should be treated in confidence.
Let me know if there is anything else you need.Kind regards,
Chris
Christopher Eddy – Freedom of Information Team DCMS – Ministerial Support Team 4th Floor, 100 Parliament Street, London SW1A 2BQ
Decision notice from ICO 2023/03/21:
The Commissioner appreciates that the withheld information includes details of Nominet’s operations. However, it is not clear to the Commissioner how or why disclosure of this would directly affect Nominet’s commercial interests, and thus be detrimental. DCMS has stated that this detriment was implied given the nature of the material. However, in the Commissioner’s view such submissions are not
ICO Freedom of Information Act 2000 (FOIA) Decision notice – Signed Decision Notice IC-165170-X2F6.pdf
sufficiently detailed enough for him to be persuaded that disclosure would be detrimental in this case. A public authority has to provide more compelling submissions than stating that the detrimental nature of the material is implied. For example, why would disclosure of the specific information that has been withheld be likely to harm the third party’s commercial interests? In what way or ways would this harm occur? And to, the complainant’s point, in the context of this case to what extent does Nominet have commercial interests? The Commissioner is therefore not persuaded that DCMS has provided sufficient evidence that disclosure of the disputed information would be detrimental for the reasons it suggests. This criterion is therefore not engaged, and as a result the Commissioner has concluded that the information is not exempt from disclosure on the basis of section 41(1).
Current Status:
- DCMS lost, but did not provide the information.
- DCMS told ICO it was going to appeal.
- ICO has given DCMS the opportunity to appeal.
- DCMS has failed to appeal in a timely manor.
- The tribunal may still accept DCMS overdue appeal.
- I will need to continue chasing this on a monthly basis.