Europe

UK police and fire services fail cybersecurity inspection

HMICFRS finds legacy IT is the biggest threat while backup systems rate unsatisfactory, same state that wants to scan every face cannot secure its own email

Images

Inspectors found some forces are not doing enough to stop human error leaving them open to attack (PA) Inspectors found some forces are not doing enough to stop human error leaving them open to attack (PA) independent.co.uk
Senior leaders are left relying on younger, less experienced staff who know more about IT, the report found (PA) Senior leaders are left relying on younger, less experienced staff who know more about IT, the report found (PA) independent.co.uk

Police and fire services across the UK are inadequately protected against cyber attacks, according to a report published on Tuesday by His Majesty's Inspectorate of Constabulary and Fire and Rescue Services. Inspectors examined three police forces and three fire and rescue services in England and Wales and rated several backup systems — the ones meant to restore operations after a breach — as unsatisfactory.

The watchdog's findings are less about hackers than about procurement habits. Chiefs in both services identified legacy IT systems as their single greatest security threat. External contractors storing sensitive police data add further exposure. Inspectors found poor password management, missing multi-factor authentication, and weak controls around staff joining, moving within, or leaving organizations. Senior leaders — most from operational backgrounds — told inspectors they did not consider cybersecurity part of daily decision-making, and relied on junior technical staff to explain risks. Investment flowed instead toward what Michelle Skeer of HMICFRS called "more operational and tangible priorities."

The report recommends baseline cybersecurity standards for all forces and services, better management of third-party contractors, and a national digital-management centre for the fire service mirroring the police one. Skeer described the threat as significant and expanding rapidly, noting that successful attacks have already been disruptive, endangered the public, and been expensive to fix.

The same state apparatus that plans permanent facial recognition on Oxford Street is running its emergency dispatch systems on software its own chiefs call obsolete.