Request ID: FOI-0373-2122 Date published: 03 June 2021
You asked
Dear Transport for London,
At the bottom of your emails (ones to people containing you), you say that your emails and attachments are scanned for viruses. You don't specify what system you use.
What system do you use to scan for viruses?
Are all emails scanned for viruses(including internal emails?) How much does this system cost per year?
Why did you pick that company over other ones?
Were you advised by another government body/person on what system to get?
What is the success rate for the scanning?
We answered
TfL Ref 0373-2122
Thank you for your request received by Transport for London (TfL) on 23 May 2021 asking for information about virus scanning of emails. Your request has been considered in accordance with the requirements of the Freedom of Information Act and our information access policy. You asked: At the bottom of your emails (ones to people containing you), you say that your emails and attachments are scanned for viruses. You don't specify what system you use. What system do you use to scan for viruses? Are all emails scanned for viruses(including internal emails?) How much does this system cost per year? Why did you pick that company over other ones? Were you advised by another government body/person on what system to get? What is the success rate for the scanning?
I can confirm that we hold the information you require. However we consider that the disclosure of information requested would assist a third party to mount an attack on our systems and therefore the information is exempt under Section 24(1) - National Security. Release of information under the Freedom of Information Act is a release to the public both at home and abroad. Therefore TfL must consider how any potential recipient of the information might use it, rather than make assumptions about the intentions of the individual making the request.
Information regarding deployed cyber security controls such as vendors, configurations, commercial arrangements, and control effectiveness could be exploited by a malicious threat actor seeking to do harm to TfL, to our network and/or our customers. This knowledge could be used to mount an attack at a later date. The London transport system is a critical piece of national infrastructure and as such we employ rigorous safeguards to protect it from cyber attack. Like other organisations we are subject to regular attempted cyber attacks. These attacks are unlawful under the Computer Misuse Act, and whilst the motive is not always apparent, we are aware of the risk to critical national infrastructure that may result from a successful attack.We consider that releasing the information you have asked for regarding our cyber security controls and capabilities would be likely to prejudice our efforts to prevent and detect future attacks and undermine our ability to safeguard TfL’ s information systems. MI5 (Security Services) has stated that, “Cyber espionage presents a real risk to the economic well-being of the UK. It poses a direct threat to UK national security’:https://www.mi5.gov.uk/cyber. They have assessed the current threat level from international terrorism for the UK is assessed as SUBSTANTIAL: https://www.mi5.gov.uk/threat-levels.
Each day (pre Corona virus levels) around 24 million journeys are made across TfL’s network and an attack directed at the running of the network may cause harm to national security by disrupting the operation of London’s transport network, with consequent economic loss.
Section 24(1) is subject to a public interest test, and we recognise that there is significant public interest in understanding the level and nature of attacks recorded by Transport for London. However, we consider that there is a stronger public interest in protecting national security, which would be undermined by the disclosure of the requested information.
If you are considering submitting a further FOI request please think carefully about whether the request is essential at this current time, as answering FOI requests will require the use of limited resources and the attention of staff who could be supporting other essential activity. Where requests are made, please note that our response time may be impacted by the current situation.
If you are not satisfied with this response please see the attached information sheet for details of your right to appeal.
Yours sincerely
Sara Thomas FOI Case Management Team General Counsel Transport for London
