An ADR investigation into the handling of confidential information in the police shows that the security of that information is inadequate. The force is too vulnerable to malicious people seeking police information. In response to the report, the police took immediate measures.
In recent months, the Audit Department of the State (ADR) investigated the handling of confidential information at both the police and the National Coordinator for Terrorism and Security (NCTV). The reason is the criminal investigation against a man arrested on October 23 last year on suspicion of leaking state secrets. The suspect worked at the NCTV. He also performed work for the police on a temporary basis for more than 20 years, including as a translator.
Henk Geveke, responsible within the force management for information security, calls the ADR report "a wake-up call. "It makes it clear that we as police have steps to take. Although there is policy regarding information security, there is a lack of supervision of that policy. Also, internal recommendations are not being followed."
Regarding the extent to which the policy around information security is actually implemented, the ADR conducted research at the so-called CTER cluster, a part of the police force that deals with counterterrorism. Geveke: "That part of the study showed that the rules around information security were not properly observed in practice. For example, insecure means of communication and data carriers were used. In doing so, exactly as the ADR states, we organized our own vulnerability."
According to Henk Geveke, the pressure in police work is sometimes very high. "Police officers are result-oriented by nature. And certainly at the organizational unit investigated, people often had to deal with acute social threats under high time pressure. I understand this pressure and appreciate the focus on results. But this should never lead to negligence."
The police took immediate action following the arrest of the interpreter. For example, security risks to employees and ongoing investigations were identified and action was taken where necessary. A higher screening level for interpreters was also implemented. Currently, all interpreters are screened at this level.
Additional measures will be taken in the coming period. Geveke: 'Starting next year, we will introduce the so-called system of protective monitoring, which will automatically analyze user actions of police officers to detect improper use of systems. There will also be mandatory awareness training for police officers who work with confidential information.'
Through the actions taken by the police, some of the ADR's recommendations have already been addressed. With the remaining recommendations, the police are moving forward. The force will report to the ADR on progress in 12 months.
