Update on Glasgow City Council’s contractual relations with military-grade Israeli company operating city centre surveillance system
As Israel’s genocidal crimes in Gaza continue unabated, the Gaza Genocide Emergency Committee (GGEC) Arms Companies Team (ACT) have been working to ensure that Glasgow City Council (GCC) are engaged in nothing that in any way enables the genocide.
Following GCC’s adoption of a strong motion of solidarity with Palestine https://www.glasgowlife.org.uk/news/glasgow-life-update-on-gaza
we have been seeking assurances that the motion’s pledges will be meaningfully effected.
In particular, we are intent on exposing Glasgow Council’s Public Space surveillance system, its contract with major corporation CGI, and CGI’s own third-party contract with Israeli company Qognify, which provides the suite of software services for monitoring Glasgow City centre.
It is darkly ironic that while Israel is using advanced surveillance tech to map-out its mass killing in Gaza, an Israeli company, founded by the same military/intelligence interests, is being allowed to provide surveillance services to monitor the people of Glasgow.
Lamentably, few of our citizens will actually know about this arrangement, because for years Glasgow Council has shown no civic interest in sharing such information.
THE CONTRACTUAL LABYRINTH
The contract between GCC and GCI has a nominal expiry/renewal/extension date of 31 March 2025. As that date approaches, our task is to garner any available information and bring the issue to maximum public attention.
Previous background reading and updates on our endeavours can be read here:
https://ggec.org.uk/israeli-military-grade-surveillance-system-is-monitoring-glasgow-city-centre/
https://ggec.org.uk/update-on-glasgow-councils-contract-with-cgi-and-its-use-of-israeli-military-grade-surveillance-company-qognify-to-monitor-glasgow-city-centre/
https://ggec.org.uk/nice-surveillance-applications-in-use-in-glasgow-summary-of-investigations-so-far-04-06-24/
Glasgow Council’s quietly-held contractual arrangements are further shrouded by the labyrinthine nature of connecting companies, as noted in this companies and contracts timeline:
2008: Joint partnership established between GCC and Serco to run ICT services, under the name of Access LLP.
2013: GCC win funding bid of £24,000,000 from UK innovation agency Technology Strategy Board. Funds used to integrate GCC city centre energy, transport and public safety systems, including Public Space CCTV (PSCCTV) system.
2013: Neptune Intelligence Computer Engineering (NICE) services founded in 1986 by ex-Unit 8200 military/intelligence personnel, “Israel’s cyber spy unit, tasked with spying on Palestinians living under Israeli apartheid.” https://palestinecampaign.org/psc-company/nice-ltd/
Note: “A 2018 study cited by Haaretz estimated that 80% of the 2,300 people who founded Israel’s 700 cybersecurity companies had come through IDF intelligence.”
https://restofworld.org/2021/inside-israels-lucrative-and-secretive-cybersurveillance-talent-pipeline/
2013: Access LLP contract NICE to run Physical Security Information Management (software: Nice Administrator; Nice Player Codec Pack Situator (aka Nice Situator); Nice Vision; NICE Perform v3.5; NiceVision IP Plugin) as part of GCC’s Public Space system.
2014: GCC Public Space system becomes fully operational.
2015: US/Israel-based technology investment firm Battery Ventures establish new company Qognify, buying the Physical Security Business Unit (PSBU) side of NICE systems. https://www.securitysales.com/news/nice_is_selling_its_video_surveillance_business_for_100m/
NICE Systems also sold off its Cyber Unit Business to Israel’s biggest arms company, Elbit Systems.
NICE Systems continues as a leading and highly lucrative international company. https://www.encyclopedia.com/books/politics-and-business-magazines/nice-systems-ltd
2017: Canadian-based corporation CGI takes over GCC contract from Access LLP; forms third-party contract with Qognify to run suite of NICE services for GCC.
2022: Qognify acquired by Swedish-founded multinational, Hexagon; CGI contract with Qognify continues. https://hxgnsecurity.com/wp-content/uploads/2022/12/Q_acquisition_2022_12_19_EN.pdf
2024: GCC award Scottish-based firm Commsworld new contract, having partly run GCC IT services since 2020. https://www.commsworld.com/
Full details of GCC contract history at https://ggec.org.uk/nice-surveillance-applications-in-use-in-glasgow-summary-of-investigations-so-far-04-06-24/
FREEDOM OF INFORMATION: OPAQUE RESPONSES
The following responses to a series of FoI questions about these contractual dealings tell us more about what is known about them and what GCC appears to think we shouldn’t know.
FoI sent 6 May 2024, response received 30 May 2024:
1.0 CITY ICT SERVICES PROCUREMENT
1.1 Who will be responsible for the SIAM (Service Integration & Management) in the proposed multi-source (supplier) model approach to ICT services for the city currently being developed/considered?
1.2 Will CGI be retained?
On inspecting our records, it would appear that the Council does not hold the information which you have requested. Neither does anyone else hold it on our behalf. Accordingly, we are unable to comply with this aspect of your request, in terms of section 17(1)(b) of the Act. Details of who will be responsible is under consideration.
2.0 PUBLIC SPACE SURVEILLANCE SOFTWARE
2.1 Do the council intend to retain the NICE software applications: NICE vision, NICE Situator & People Search as part of the spec for the proposed multi-source model approach to ICT services?
On inspecting our records, it would appear that the Council does not hold the information which you have requested. Neither does anyone else hold it on our behalf. Accordingly, we are unable to comply with this aspect of your request, in terms of section 17(1)(b) of the Act. This information is not yet held. The Council will provide requirements to which any future IT provider will confirm the best software to meet said requirements.
2.2 Are there any other NICE/Qognify software applications specified/included?
The following software is used by the Council:
- Nice Administrator
- Nice Player Codec Pack
- Situator (aka Nice Situator)
- Vision (aka Nice Vision)
- NICE Perform v3.5
- NiceVision IP Plugin
2.3 We understand People Search (also known as Suspect Search) was purchased in 2018 but is not in operation. Please confirm this is still the case.
We can confirm that Person Search is not currently in operation.
2.4 We understand there were data protection impact assessment issues regarding the use of “people search”, which were raised by the Information Commissioner Office (as reported in 2020 Justice Sub-Committee on Policing report). Are these resolved? Do the council have all approvals in place now to allow the application to be used? If not, what are the barriers and what is being done to solve these?
We can confirm that the Council was asked a number of questions relating to Person Search by the Scottish Parliament Justice Sub-committee, not the Information Commissioner’s Office (ICO). We responded in full to those questions (and some supplementary questions) at that time. The Council takes the view that the operational use of this software will require a Data Protection Impact Assessment (DPIA) and that this DPIA once completed internally is likely to require prior consultation with the ICO. Work on the DPIA highlighted the need to improve information governance arrangements with Police Scotland first. Work on improving these arrangements has been prioritised over finalising the DPIA and consulting with the ICO.
2.5 In regards to the “people search” software/application costs: how much did the “people search” software cost when purchased?
On inspecting our records, it would appear that the Council does not hold the information which you have requested. Neither does anyone else hold it on our behalf. Accordingly, we are unable to comply with this aspect of your request, in terms of section 17(1)(b) of the Act. The purchase of software is provided as part of the overall service package with CGI. CGI is not subject to the Act.
Have there been update/maintenance/ongoing costs incurred year on year in the intervening period?
No
If so, what have these been year on year?
N/A
Is there a planned timescale to activate the People Search software application?
Not at this time
2.6 How many cameras currently have this installed?
None
3.0 QOGNIFY / HEXAGON
3.1 Will this company be retained as a consultant/supplier within the proposed multi-source (supplier) model approach to ICT services for the city currently being developed/considered?
OR
Will it be tendered allowing non-Israeli vendors to quote for the service/work?
On inspecting our records, it would appear that the Council does not hold the information which you have requested. Neither does anyone else hold it on our behalf. Accordingly, we are unable to comply with this aspect of your request, in terms of section 17(1)(b) of the Act. This information is not yet held. The Council will provide requirements to which any future IT provider will confirm the best software to meet said requirements.
3.2 If Qognify / Hexagon are being retained, why are they being considered to be eligible for appointment as a single source provider?
Requests for information submitted under The Freedom of Information (Scotland) Act 2002 allows access to recorded information, provided no exemptions apply. On checking this part of your correspondence you have not asked for any recorded information, therefore, your request does not fall within the scope of the Act.
HONOURING THE MOTION: FURTHER FOI ENQUIRIES
Another set of FoI enquiries to GCC and responses shows key questions still unanswered.
FoI questions sent 15 June 2024, response received 2 July 2024:
- Part of Glasgow Council’s recently-passed ‘Solidarity With Palestine’ motion includes the following pledge: “Council commits to widening the present human rights due diligence process when making awards decisions by bringing a report to the City Administration Committee detailing actions that the council can lawfully take to assure itself of supply chains that do not conflict with international humanitarian law and seek legal expertise where necessary to advise this.“
Has that report to the City Administration Committee been initiated or delivered yet?
We can advise you that the report is currently being prepared and will be taken to a future City Administration Committee meeting after the summer recess.
- The motion also asks of the proposed report:
“Council further requests that this report considers an assessment of current Council procurement contracts which include goods or services which have been wholly or partly manufactured, assembled, or operated by companies operating in the occupied territories, as per the updated United Nations database of business enterprises in relation to the Occupied Palestinian Territories.”
In light of GCC’s adoption of a new “multi-source model” – under its “Future of Digital and ICT Services (FICT) project” – to replace the Public Space surveillance system/services currently operated by CGI/Qognify, what specific body/committee has been tasked with examining the ethical suitability of any new contract bidders, and has it acted to ensure that none of them fall within this listing?
This is not applicable to Glasgow City Council. We can confirm that the Council is not tendering for a replacement of the Public Space surveillance system/services.
- Alongside Glasgow Council’s recommendation to appoint Commsworld as system operator of its network services in place of CGI (as agreed by the Contracts and Property Committee meeting of 23 May 2024), which companies, if any, are tendering to deliver the other services currently in use under the NICE/Qognify suite of surveillance services (namely, Nice Administrator, Nice Situator, Nice Vision, NICE Perform v3.5 NiceVision IP Plugin)?
This would be not applicable to the Council as we can advise that the Council is not tendering for any of these services.
- Has the body/committee examining these bids and the ethical requirements around them adopted the motion’s “widen[ed] due diligence” remit in looking at the Commsworld appointment and other potential tenders?
We can confirm that the Council is not tendering for any of these services, therefore there are no bids.
- What plans and arrangements with trade unions are in place for redeploying CGI staff currently working on the Council’s Physical Security Information Management (PSIM) video management and related Public Space services when the current contract with CGI expires in March 2025?
Again, this is not applicable to Glasgow City Council. We would advise that the Council has no responsibility for CGI staff.
CONFLICTING RESPONSES
As revealed in a further batch of (appeal level) FoI responses, it now appears that, contrary to prior assurances, GCC’s “multi-source model” – under its “Future of Digital and ICT Services (FICT) project” – to replace the Public Space model may not, after all, exclude the use of NICE services. GCC has also intimated that the renewal date for any such services will also remain fluid and open to potential further procurement.
FoI appeal for review questions, sent 4 July 2024, response received 29 July 2024:
I am part of a GGEC (Gaza Genocide Emergency Committee) working group and have been involved in some research into the applications and software deployed to manage the Public space CCTV systems in Glasgow. The software and applications in place are designed by an Israeli company NICE. They are managed by an Israeli company Qognify who are employed by Glasgow City Council via a third-party contract with CGI (who are currently contracted to deliver the city’s ICT services). The ICT service is moving to a new delivery model as the current contract with CGI expires on the 31st March 2025. Procurement of new contractors, suppliers, consultants and the like is ongoing in this regard. As concerned citizens, we have been investigating this for a few months now, and as part of this we have raised several Freedom of Information requests. Several of our queries have been returned without a clear answer. I have tabulated these in the attached pdf document. I would like these reviewed, please.
I have carried out a full and impartial review of the initial response provided to you. I can confirm that I have upheld the Council’s original decision that the information which you seek is not held by the Council and as such, the Council is unable to comply with your request in line with Section 17(1)(b) of the Act.
By way of advice and assistance, I can advise that this information is not held because a decision has not yet been made on this matter and commercial negotiations with CGI are ongoing, which therefore means that no such information is held. Furthermore, I can confirm that the “Road to Multi-Source Strategy” currently assumes that the NICE software applications, namely NICE vision, NICE Situator & People Search will be retained. In future, under the Road to Multi-Source Strategy, the Council will identify and provide requirements for digital solutions and applications and future IT service providers will confirm the best software to meet those requirements. In terms of your initial question 2.1 we are therefore unable to confirm if the NICE and People Search software will be retained indefinitely in future.
By way of further advice and assistance, I can advise that the Qognify contract is a contract between CGI and Qognify and the Council has no direct contractual arrangement with Qognify. The Council are therefore unable to provide the information you have requested as we do not hold any recorded information in this regard. By way of advice and assistance I can confirm that it is not the case that all contracts within the new multi-source model need to be finalised and operational by 31st March 2025. The shift to a multi-source model under the Council’s Road to Multi-Source Strategy is defined by a phased transition and a series of procurement exercises over a period of years.
SECURITY CONCERNS: FOI REQUESTS AND AWAITED RESPONSES
Alongside these unresolved matters sits a number of additional issues, including unaddressed security concerns
https://www.otorio.com/blog/exploiting-ip-video-surveillance-systems/ over NICE operational services, and failures of full and proper audit procedures. https://ggec.org.uk/nice-surveillance-applications-in-use-in-glasgow-summary-of-investigations-so-far-04-06-24/
FoI questions sent, 11 August 2024, regarding the vulnerability and audit issues:
Through an FOI response dated 30th May (AB/8200458) GCC confirmed the Nice Vision is in operation in Glasgow as part of the PSCCTV.
America’s Cyber Defense Agency reported in October 2023: “Qognify NiceVision versions 3.1 and prior are vulnerable to exposing sensitive information using hard-coded credentials. With these credentials an attacker can retrieve information about the cameras, user information, and modify database records”.
Additionally, Otorio, an Israeli Cyber Security Company, produced a report in June 24 on recently discovered “severe vulnerability in Qognify NiceVision, IP-video surveillance system”. Otorio have reported that the “vulnerability, known as CVE-2023-2306 has a CVSS score of 10” and that this “highest criticality poses both physical and cybersecurity threats to facilities”.
Our queries/information requests in this regard are noted below:
1.0 We are aware the council subcontracts ICT services (current contract with CGI) and the contract with the provider of NICE vision sits with this subcontractor. Has CGI reported this security issue/vulnerability to Glasgow City Council?
2.0 Has this security issue/vulnerability been investigated?
3.0 If so, can we have copies of these reports?
4.0 Can you confirm what steps, if any, have been taken to protect against these vulnerabilities?
5.0 Has any risk assessment of the system been carried out (both before and after installation of the most recent version of this software being installed)?
6.0 If so, can we have copies of these?
7.0 Can you confirm all associated risks have been eliminated, and if not what risks still exist through the ongoing use of this software?
8.0 If not, please confirm what actions are outstanding.
FURTHER QUESTIONS ON QOGNIFY AND FUTURE CONTRACTS
Another effort has been made to seek clarification on GGC’s “phased transition” of contracts and “series of procurement exercises over a period of years”.
FoI questions, sent 12 August 2024:
We have learned the following through previous FoI responses from GCC:
The “current Public Space CCTV system in Glasgow is in part supported by an Israeli organisation called Qognify.”
“The contract with Qognify is with CGI our ICT service provider.”
“The contract for the NICE applications software is between CGI and Qognify.”
“Under the Road to Multi-Source Strategy, the Council is moving to a multi-source model for the delivery of digital and ICT services. This is defined by a phased transition and a series of procurement exercises over a period of years”.
Please advise:
1.0 How many procurement exercises are planned?
2.0 Which of these “procurement exercises” includes the services Qognify are contracted to provide, including the NICE applications and software?
3.0 What is the timeline for this “procurement exercise”?
SUMMARY AND CONCLUSIONS
In sum, significant information on past and current dealings between GCC and its contracting parties remains hidden or otherwise undisclosed.
However, after multiple FoI exchanges, retrieval of additional council documentation, and valued input from academic and professional advisers, we are able to relate the following qualified information.
As part of a proposed new “multi-source model” to replace its Public Space surveillance system, GCC has awarded a contract for the provision of Network Services to Commsworld Limited, a company already utilised, and seemingly well favoured, by GCC.
A central question remains, however, over GCC’s ongoing dealings with CGI. We understand that there are plans for voluntary redundancy/absorption of remaining CGI and GCC seconded staff. Yet, this has still to be confirmed by GCC.
There remains no clear confirmation that CGI will be excluded from any remaining procurement process, most notably the operation of existing NICE software/services. There is only a declared GCC “confirm[ation] that the “Road to Multi-Source Strategy” currently assumes that the NICE software applications, namely NICE vision, NICE Situator & People Search will be retained.”
GCC add: “In future, under the Road to Multi-Source Strategy, the Council will identify and provide requirements for digital solutions and applications and future IT service providers will confirm the best software to meet those requirements.”
Thus, if the NICE services currently operated by CGI/Qognify are to be retained, whether indefinitely or not, who will run them? Again, GCC’s responses here seem to indicate that CGI would be a prime candidate to “meet these requirements”.
If these NICE services are retained or continued, by CGI or any other company, this would violate the very pledge contained in the adopted motion of 28 March 2024 that GCC will not in any way engage in commercial or other practices that enable the genocide.
In another set of FoI questions, we asked whether GCC’s main Administration Committee has utilised its now expanded role, as intimated in the adopted motion, to probe the contract process for any inclusion, current or forthcoming, of CGI/Qognify and potential retention of NICE services.
A reply from GCC states that a report on the matter was due to come before its Administration Committee meeting after the 2024 summer recess. We await notification of it on the Committee agenda list.
We have also highlighted key questions for GCC on the disturbing extent of vulnerabilities within the suite of CGI/Qognify/NICE system services and lack of proper audit/oversight.
Again, we await replies to these questions.
It is hoped that the open sharing of our information here, including all of GCC’s opaque and evasive responses, will encourage greater public scrutiny of the contract process, with the ultimate aim of removing Qognify and any other Israeli-linked commercial entity from the books of Glasgow City Council.