GGEC Arms Companies Team update, 4 June 2024.
Further to our previous statement, a summary, to date, of investigations into NICE surveillance applications being used in Glasgow City Centre.
| 1.0 | Background |
| 1.1 | City ICT services : An outsourced service 2008 – 2024 |
| Glasgow City ICT services include the city surveillance systems. The City ICT services are currently outsourced to private contractors and have been since 2008. | |
| City ICT services were delivered via a Joint Partnership between Glasgow City Council and Serco from 2008 to 2018. This was a 50/50 partnership. The joint partnership operated under the name ACCESS LLP. | |
| Since the 1st April 2018 Glasgow City ICT services have been fully outsourced to a Canadian based private company called CGI. This seven-year full ICT outsource contract runs until 31 March 2025. | |
| Since October 2013 the software and applications used to manage the city surveillance systems and generate data have been delivered by an Israeli company through third party contracts (initially with ACCESS LLP and currently with CGI). | |
| Neither Access LLP nor CGI are subject to the Freedom of Information (Scotland) Act 2002. | |
| 1.2 | City ICT services : multi-source model from March 2025 |
| Through a Freedom of Information request (FOI) the council have confirmed that when the current CGI contract expires in March 2025, the city ICT services will be managed using multiple specialist suppliers. This approach is called a Multi-Source Model. Such a model requires either in-house expertise to deliver the SIAM (Service Integration and Management) or for this role to be outsourced. Some organisations deploy a hybrid model. Responses to FOI requests and internet searches do not give clarity on which model GCC are moving forward on. | |
| There is an FOI response to questions which says Glasgow City Council will hold responsibility for the SIAM, however they also say that no decision has been made yet on whether the services of GCI will be retained beyond 2025. Additionally an “industry briefing” in March 2023 indicates that GCC were of the opinion they did not have the necessary SIAM skillset internally to take on this role. The council web page on ICT also indicates CGI are being retained. | |
| We believe procurement of the specialist suppliers has commenced. Item 5 of the Contracts and Property Committee meeting on the 23rd May 2024 requests that the committee approve the award of a contract for the provision of Network Services to Commsworld Limited. It states that all services will be transferred from GCI to Commsworld by the 31st March 2025. This includes migration of CGI staff and seconded council staff. We do not know the timescale for other tender packages to be awarded. | |
| Commsworld appear to be the incumbent contractor having been awarded the network contract previously in 2020 as a third party contractor in partnership with CGI. | |
| 1.3 | Funding & initial installation of the current city Public Space CCTV systems |
| In January 2013 Glasgow City Council (GCC) won a bid for funding of £24,000,000 from the UK’s innovation agency (Technology Strategy Board or TSB) through a “Future Cities Demonstrator” competition. | |
| The funds were used to integrate GCC city centre energy, transport and public safety systems. This included the city Public Space CCTV (PSCCTV). | |
| The integrated PSCCTV system funded through this award was up and running by 2014. | |
| The project expenditure was managed by ACCESS LLP who had delegated authority to award contracts on behalf of GCC without a need to gain council or committee approvals. | |
| 1.4 | The Glasgow Operation Centre (GOC) |
| The creation of an operations centre was part of the 2013 funding package. The GOC is home to Glasgow City Council’s Public Space CCTV monitoring services, City Security Services, the Partnership Intelligence Unit and the Traffic Control Centre. | |
| 1.5 | Cameras in use |
| There are 429 fixed public space CCTV cameras across the city as well as 98 traffic cameras and eight re-deployable cameras. | |
| 1.6 | Data sharing agreements |
| There are data sharing agreements to allow the data generated from the PSCCTV to be shared with : Police Scotland, HMRC and the DWP. (This has been confirmed through access to an internal audit document dated 25th January 2023) | |
| 2.0 | NICE systems & Glasgow City Council |
| 2.1 | The systems in use currently |
| The video management & PSIM (Physical security information management) from 2014 to this day is based on the use of applications and software which are designed and owned by an Israeli company. | |
| These applications are deployed to integrate systems, analyse and correlate information and data across these systems as well as manage the CCTV surveillance coverage. Additionally they control, and coordinate response actions | |
| Through FOI, GCC have confirmed the following NICE systems are currently in use : Nice Administrator Nice Player Codec Pack Situator (aka Nice Situator) Vision (aka Nice Vision) NICE Perform v3.5 NiceVision IP Plugin | |
| 2.2 | NICE ownership |
| Nice systems Ltd is an Israeli company. In 2015 two parts of the company were sold. | |
| The Nice Systems Cyber Unit Business was acquired by Israeli company Elbit Systems Ltd. | |
| The Nice systems Physical Security Business Unit (PSBU) was sold to Israeli technology investment firm Battery Ventures. REF 10 | |
| Through this acquisition Battery Ventures established an independently operating business named Qognify. Nice Systems Ltd were rebranded as Qognify. | |
| In April 23 Qognify was bought by Hexagon. | |
| 2.3 | NICE systems use in Glasgow City Council PSCCTV |
| Through FOI, we have learned that the contract with Nice systems commenced on 25 October 2013. Nice systems were originally contracted as a 3rd party service provider through a direct contract with ACCESS LLP who were responsible for managing the city ICT services at the time. | |
| Through FOI, GCC have confirmed Qognify as an Israeli company. They have also confirmed they are still a third party service provider to Glasgow City Council but now through a direct contract with CGI who are currently the outsourced company responsible for managing the city ICT services. | |
| The council have been asked through FOI if Qognify / Hexagon will be retained as a consultant/supplier within the proposed multi-source model approach to ICT services planned once the CGI current contract expires on March 31st 2025. The response is not clear (see 2.5). | |
| 2.4 | Potential use of NICE Suspect Search software in Glasgow |
| There is an additional application which GCC have access to within the suite of Nice applications they have purchased. This is additional to those highlighted under item 2.1. | |
| This application, called Suspect Search, allows a search for an individual using a reference based a recorded image, an uploaded full body photo, or by creating a composite or avatar using characteristics. The system can simultaneously search for multiple targets in several cameras. It automatically filters out irrelevant images and presents only relevant results. There is a great deal of controversy around use of this application in regards data protection, invasive surveillance and stalking as well as its use to identify people who have not committed crimes but are being monitored by authorities because of political beliefs and the like. | |
| Glasgow City Council call this application Person Search. | |
| In 2019 an FOI response stated that operational use of Person Search would not be made until the necessary Data Protection Impact Assessment had been completed. | |
| Through a recent FOI request we have learned the following in regards the status of any future use of Person Search: | |
| Person Search is not currently in operationOperational use of this software still requires a a successful Data Protection Impact Assessment (DPIA) to be completedThis DPIA once completed will require consultation with the ICO Work on the DPIA to date has highlighted the need to improve information governance arrangements with Police Scotland Work on improving these arrangements is ongoing | |
| The responses indicate that Person Search is still being planned as an operational tool within the new ICT services Glasgow City PSCCTV surveillance systems. | |
| 2.5 | Use of Qognify & NICE applications in the multi-source model approach to ICT services |
| We have asked through an FOI request whether Qognify and the Nice applications (those currently in use and Person Search) would be retained in the multi-source model approach to ICT services currently being planned and procured. | |
| Responses do not clearly address this question and state that the council will specify the requirements for the PSCCTV and that the future IT provider will confirm the best software solutions to meet that specification. | |
| It appears Israeli company Qognify could continue to be deployed along with NICE software and applications. | |
| We believe this contravenes the particulars set out in the GCC motion on Palestine which was passed on March the 28th and which was overwhelmingly supported by councillors with only 2 dissenting voices. | |
| 3.0 | Security Concerns |
| 3.1 | Due Diligence audits of contractors employed by the private contractor who the City ICT services are outsourced to |
| Through FOI we asked Glasgow City Council to confirm if they held any documentation in regards the remit of the third party contractor Qognify PSCCTV. They answered no. | |
| The council did confirm that they conducted a due diligence exercise for all 3rd party contractors / consultants within the CGI contract prior to the appointment of CGI (2017). | |
| The council have also confirmed that since this time, no further audits of this company have been carried out by the council. | |
| Ownership of Qognify has changed within this 7 year period. We assume many software updates have been carried out. Glasgow City councils policies in regards procurement will no doubt have changed. Qognify are part of a fully outsourced council service agreement and we would have expected regular audits to be carried out to check that both the quality of service, and the costs of the service have been meeting expectations, performance criteria and value for money criteria. | |
| 3.2 | Internal Audit Report January 2023 |
| A report to the City Council Internal Audit Section Committee in regards the PSCCTV information management was tabled on the 25th January 2023. The scope of the audit was to ensure there are sufficient and appropriate controls in place covering the Council’s PSCCTV operations regarding the management of PSCCTV data. This report highlights a number of concerns : | |
| There were a number of areas where controls needed strengthenedThe risk register did not include risks and mitigating controls relating to the sharing of PSCCTV data with third parties Data sharing agreements were not up-to-dateAn overarching data sharing agreement for Police Scotland, which was to include PSCCTV was not yet in placeThere was no documented evidence that those removing PSCCTV data were aware of their responsibilitiesDocumentation of those with ID passes for the multiple security doors into the GOC was not availableFrom a sample of 10 system users the audit identified one user who had retired a couple of months earlier but still had a security passThe ICO registration was out of date and did not reflect council changes | |
| The audit included a 4 point plan to rectify matters and a time limit to rectify was given as 31st April 2023. | |
| Through FOI request the council have confirmed the recommendations of the report were implemented within the timescale given. We have however found evidence of further concerns in regards security procedures relating to the PSCCTV since this time. | |
| 3.3 | Internal Audit Reports |
| During May we discovered a report entitled : Finance and Audit Scrutiny Committee: Internal Audit 2023/24 Mid-Year Report : November 2023. The link to this report is no longer available due to the recent update of the council web site “Our website has recently been updated and the location of some webpages has changed”. We have been unable to find this documents new home. | |
| The report mentioned signigant issues which needed to be addressed relating to the council ICT. We asked the following in a recent FOI request : | |
| Please advise if the “significant issues” relate to the Public space CCTV system and or the control centre If so what are these issues? What are the key security metrics mentioned in the report? Please provide details of the action plan mentioned in the report What is the current situation and are there still any outstanding matters? If so what are these and what is the timeline to have these rectified? | |
| Had the significant issues not been related to the Public space CCTV system and or the control centre we would have expected a no answer to bullet number one above. The answer we received however raises some concerns these issues may relate to these systems : | |
| “the information you have requested would, or would be likely to, prejudice substantially the prevention or detection of crime. In our opinion, release of information which would disclose knowledge of our systems and operations designed to prevent and detect crime” | |
| Additionally we have found a register of audit recommendations dated 26th April 2024 which has mention of an ongoing IT assurance issue whereby CGI are being asked to finalise an ICT and cyber security remediation action plan and ensure rapid implementation. | |
| 3.4 | Press reports on Police access to the PSCCTV data |
| Various press outlets reported in August 2023 that the council had halved the number of GCC staff monitoring the PSCCTV from 18 to 9. | |
| Previously cameras were monitored 24 hours per day and from September 23 this was reduced to 12 hours a day. Cameras still record 24 hours a day and when not monitored they are left in priority positions. | |
| The evening times reported the following on the 31st May : | |
| “ Unions fear the network of street cameras in Glasgow has been used by external staff to monitor several big events in the city during hours council staff are not present. GMB Scotland says the monitoring team have arrived at recent shifts to find the cameras have been monitored during times they were not meant to be, notably on Saturday, May 4 when an All Under One Banner independence march was tracked through the city and on Saturday, May 11 when football fans were watched before and after the Celtic v Rangers game at Celtic Park. “ | |
| This indicates procedures and security controls are still an issue. |