FOI request detail

TFL security systems for employees

Request ID: FOI-0847-2425
Date published: 09 July 2024

You asked

Hello I would like to know more on the security TFL have in place for employees logging in to TFL systems remotely, outside of a TFL building. I understand employees that are logging into TFL systems, within a TFL building are only required to enter their username and password to gain access. The internet infrastructure recognizes that that employee is in the building and therefore grants access. What additional security measures do TFL have in place for employees that are not in a TFL building and are accessing the TFL network and systems remotely from home, hotels cafes and other non TFL buildings. Does TFL have any extra additional security measures in place to protect username and passwords being hacked, stolen whist employees use personal internet provides at home and third party internet provides when in cafes or other places that do not have the same security as a TFL building. Most public companies use a 2 factor authentication process which sends employees a text message with a code to verify its the correct person loggi9ng in. Does TFL have anything like this in place to protect public information.

We answered

TfL Refs: FOI-0846-2425 & FOI-0847-2425

Thank you again for your requests which we received on 13 June 2024. You asked how many TfL staff members were present at 5 Endeavour Square and how many of them were British on specific days, and you also wanted to know about security measures for remote working.

Your requests have been considered in accordance with the requirements of the Freedom of Information Act and our information access policy.  I can confirm that we hold some of the information you require. 

 

However, in accordance with section 12 of the FOI Act, we are not obliged to comply with a request if we estimate that the cost of determining whether we hold the information, locating and retrieving it and extracting it from other information would exceed the appropriate limit of £450 set by the Freedom of Information (Appropriate Limit and Fees Regulations 2004). This is calculated at £25 per hour for every hour spent on the activities described. 

Under Regulation 5(2) of the Data Protection and Freedom of Information (Appropriate Limits and Fees) Regulations 2004, we are permitted to aggregate requests. We have estimated that it would exceed the cost limit to provide a response to the aforementioned two requests. 

We have determined that to process request FOI-0846-2425, about staff members at 5 Endeavour Square, alone would be very burdensome. According to the gate line data, there were nearly 11,000 employees present at 5 Endeavour Square on the dates you have requested. In order to confirm the individual’s nationality, we would need to manually check each name against our HR records. It would considerably exceed the cost limit to try to retrieve and compile this information. Therefore in combination with your other request, the time taken to process the requests would considerably exceed the cost limit. 

To help bring the cost of responding to your request within the £450 limit, you may wish to consider narrowing its scope so that we can more easily locate, retrieve and extract the information you are seeking. As we are issuing a refusal notice in relation to the aggregated cost limit you may wish to revise your requests and priorities which information you require within the 18-hour limit, ensuring your request is as specific as possible. 

We also suggest that, before submitting future requests, you consider which information is of the highest priority to ensure that the processing time available is spent on the information that is of most importance to you. 

Please see the attached information sheet for details of your right to appeal as well as information on copyright. 

Yours sincerely

Eva Hextall 

FOI Case Management Team

General Counsel

Transport for London

Back to top

Want to make a request?

We'll email you the response within 20 working days.


We'll publish the response online without disclosing any personal information.