Our Ref:         FOI-0358-1920

Thank you for your request received on 2 May 2019 asking for information about Crossrail train technology.

Your request has been considered in accordance with the requirements of the Freedom of Information Act and our information access policy. I can confirm we do hold the information you require. You asked for:

On your Class 345 Crossrail trains:
• Is security monitoring taking place on board your trains and in what capacity?
• How many trains have this level of security monitoring?
• How many train systems have firewalls in place?
• Is there any network connection between your passenger systems and your operational systems or security systems?
• Do your passenger systems, operational systems and safety systems use the same communications gateway?

On the Crossrail fleet as a whole (the same questions):
• Is security monitoring taking place on board your trains and in what capacity?
• How many trains have this level of security monitoring?
• How many train systems have firewalls in place?
• Is there any network connection between your passenger systems and your operational systems or security systems?
• Do your passenger systems, operational systems and safety systems use the same communications gateway?

The other fleets currently operated by TfL Rail on the Crossrail route comprises Class 315 and 360s trains which will replaced by Class 345 when Crossrail fully opens.
In accordance with the FOI Act, we are not obliged to release the information requested above as this information is subject to statutory exemptions to the right of access to information, under Section 38(1)(b) of the Act. Disclosure of this information to you has to be regarded as a disclosure to ‘the public at large’. This information could potentially be obtained and utilised by individuals who may have hostile intentions and wish to use this information to cause disruption, commit crimes or breach the security of the Crossrail network once it becomes part of the larger TfL rail network.

TfL’s rail network is an attractive terrorist target for several reasons. It forms part of the nation’s critical infrastructure by virtue of its central importance to the functioning of London and its economy. Disclosure of information could compromise security and safety preparedness on our network and could place members of the public and TfL staff at risk.

The Information Commissioner’s Office has issued a Decision Notice regarding the application of section 38 to withhold information, we believe the same arguments can be applied:

https://ico.org.uk/media/action-weve-taken/decision-notices/2017/2013536/fs50633090.pdf

The use of these exemptions are subject to an assessment of the public interest in relation to the disclosure of the information concerned. We recognise the need for openness and transparency by public authorities, and acknowledge that there is some public interest in this information from a public safety perspective. However, disclosure of this information to you has to be regarded as a disclosure to ‘the public at large’. This information could potentially be obtained and utilised by individuals who may wish to use this information to cause disruption or harm to London’s transport infrastructure. In this instance, minimising the risk to transport infrastructure and protecting the welfare of members of the general public outweighs the public interest in disclosure.

What action has Crossrail taken in response to the NIS directive from the EU?

The affected systems on Crossrail Class 345 fleet, ordered in 2014, are being reviewed by the manufacturer against the NIS Regulation to ensure the level of security of network and information systems is still appropriate to the current risk posed.

If this is not the information you are looking for, or if you are unable to access it for some reason, please feel free to contact me.

Please see the attached information sheet for details of your right to appeal.

Yours sincerely

Gemma Jacob
Senior FOI Case Officer
FOI Case Management Team
General Counsel
Transport for London

[email protected]