2022/24986 - NSO Group, DarkMatter Group and Quadream
REQUEST
Please disclose all correspondence with the companies NSO Group, DarkMatter Group and Quadream. I would also like to know of all meetings that took place between the police force and representatives from the companies, including time, place, names of those present and the agenda and any notes taken.
RESPONSE
‘Neither Confirm nor Deny’ (NCND)
There may be occasions when complying with the duty to confirm or deny under section 1(1)(a) would in itself disclose sensitive or potentially damaging information that falls under an exemption. In these circumstances, the Act allows a public authority to respond by refusing to confirm or deny whether it holds the requested information.
The decision to issue a ‘neither confirm nor deny’ response is not affected by whether we do or do not hold the information but relates to the consequences of confirming or denying the information is held. The starting point and main focus in most cases will be theoretical considerations about the consequences of confirming or denying that a particular type of information is held. The decision to neither confirm nor deny is separate from a decision not to disclose information and needs to be taken entirely on its own merits.
Gwent Police follow the Information Commissioner’s Guidance in relation to ‘NCND’ and you may find it helpful to refer to this at the following link:
Harm
Disclosure under FOIA is a release to the public at large. Whilst not questioning the motives of the applicant, confirming or denying that information is held regarding business with the NSO Group, DarkMatter Group or Quadream, would show criminals the capacity, tactical abilities and capabilities of the force, allowing them to conduct their criminality and avoid detection. Confirming or denying any information is held relevant to this request, would lead to an increase of harm to investigations and compromise law enforcement. This would be to the detriment of providing an efficient policing service and a failure in providing a duty of care to all members of the public.
The threat from terrorism cannot be ignored. It is generally recognised that the international security landscape is increasingly complex and unpredictable. Since 2006, the UK Government has published the threat level based upon current intelligence, and that threat is currently judged as “SUBSTANTIAL”, meaning that an attack on the UK is likely. It is well established that police forces use tactics and technology to gain intelligence in order to counteract criminal behaviour, and it has been previously documented in the media that many terrorist incidents have been thwarted due to intelligence gained by these means.
Confirming or denying that business has been conducted with any of the three named companies would limit operational capabilities as criminals/terrorists would gain a greater understanding of the police forces’ methods and techniques, enabling them to take steps to counter them. It may also suggest the limitations of police capabilities in this area, which may further encourage criminal/terrorist activity by exposing potential vulnerabilities. This detrimental effect is increased if the request is made to several different law enforcement bodies. In addition to the local criminal fraternity now being better informed, those intent on organised crime throughout the UK will be able to ‘map’ where the use of certain tactics are or are not deployed. This can be useful information to those committing crimes. It would have the likelihood of identifying location-specific operations which would ultimately compromise police tactics, operations and future prosecutions as criminals could counteract the measures used against them.
Any information identifying the focus of policing activity could be used to the advantage of terrorists or criminal organisations. Information that undermines the operational integrity of these activities will adversely affect public safety and have a negative impact on both national security and law enforcement.
Section 24 and Section 31 are qualified prejudice based exemptions, and evidence of harm and a public interest test must be conducted.
Public Interest Test
Factors favouring Confirming or Denying for Section 24 - The information, if held, only relates to national security and confirming or denying whether it is held would not actually harm it. The public are entitled to know what public funds are spent on and what security measures are in place, and by confirming or denying if business is conducted with any of the three companies named would lead to a better informed public.
Factors against Confirming or Denying for Section 24 - By confirming or denying whether any information is held would render Security measures less effective. This would lead to the compromise of ongoing or future operations to protect the security or infra-structure of the UK and increase the risk of harm to the public.
Factors favouring Neither Confirming or Denying for Section 31 - Confirming or denying whether business is conducted with any of the three named companies would provide an insight into the Police Service. This would enable the public to have a better understanding of the effectiveness of the police and about how the police gather intelligence. It would greatly assist in the quality and accuracy of public debate, which could otherwise be steeped in rumour and speculation. Where public funds are being spent, there is a public interest in accountability and justifying the use of public money.
It is well known that the police use hi-tech specialist equipment and confirming or denying whether any information is held would ensure transparency and accountability and enable the public to see what tactics are deployed by the Police Service to detect crime.
Factors against Confirming or Denying for Section 31 - Confirming or denying that any information is held regarding business with any of the three named companies would have the effect of compromising law enforcement tactics and would also hinder any future investigations. In addition, confirming or denying methods used to gather intelligence for an investigation would prejudice that investigation and any possible future proceedings.
It has been recorded that FOIA releases are monitored by criminals and terrorists and so to confirm or deny information is held concerning specialist covert tactics would lead to law enforcement being undermined. The Police Service is reliant upon all manner of techniques during operations and the public release of any modus operandi employed, if held, would prejudice the ability of the Police Service to conduct similar investigations.
By confirming or denying that a business interest exists would hinder the prevention or detection of crime. The Police Service would not wish to reveal what tactics may or may not have been used to gain intelligence as this would clearly undermine the law enforcement and investigative process. This would impact on police resources and more crime and terrorist incidents would be committed, placing individuals at risk. It can be argued that there are significant risks associated with providing information, if held, in relation to any aspect of investigations or of any nation's security arrangements so confirming or denying that information is held, may reveal the relative vulnerability of what we may be trying to protect.
Decision
The security of the country is of paramount importance and Gwent Police will not divulge whether any information is or is not held regarding business with any of the three named companies, if to do so would place the safety of an individual at risk, undermine National Security or compromise law enforcement.
Whilst there is a public interest in the transparency of policing operations and providing assurance that the Gwent Police is appropriately and effectively engaging with the threat posed by various groups or individuals, there is a very strong public interest in safeguarding the integrity of police investigations and all areas of operations carried out by police forces throughout the UK.
As much as there is public interest in knowing that policing activity is appropriate and balanced this will only be overridden in exceptional circumstances. The use of technology can be a sensitive issue that would reveal police tactics and therefore it is our opinion that for these issues the balancing test for confirming or denying whether any information is held regarding the police and any of the three named companies is not made out.
However, this should not be taken as necessarily indicating that any information that would meet your request exists or does not exist.
Section 40 is a class based absolute exemption, and there is no requirement to evidence harm or consider the public interest test.
Section 40(5) – Personal Information
The exemption applicable to the information you have requested for this question can be found at Section 40(5) – Personal Information, of the Act and this refusal notice is issued under Section 17.
Disclosure under Freedom of Information is a release of information to the world in general and not an individual applicant. Therefore, simply confirming or not that such information were held would disclose personal information about individuals.
As such, any disclosure that identifies an individual or identifies that an individual has had contact with Gwent Police or not is exempt. Personal data is defined under Section 10 of the Data Protection Act 2018 as:
Data which relate to a living individual who can be identified-
(a) from those data, or
(b) from those data and other information, which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual. “
In accordance with the Act, this represents a Refusal Notice for this part of your request. No inference can be taken from this refusal that the information you have requested does or does not exist.
Under Section 16 of the Freedom of Information Act 2000, we have a duty to assist you where possible. Therefore, to establish if personal data is being processed by Gwent Police, individuals are required to make application under section 7 of the Data Protection Act 1998, by means of submitting a completed Data Protection Subject Access form.