On the afternoon of 8 August 2023 the Police Service of Northern Ireland published a response to a freedom of information request on the public site What Do They Know. Attached was a spreadsheet whose contents included surname, initials, rank, role, location, gender and service number for all 9,483 serving officers and civilian staff, including those in surveillance and intelligence roles.
The PSNI later confirmed the data was accessed around 300 times before removal, and that dissident republicans were among those who obtained it. The Information Commissioner’s Office announced an intended fine of £750,000. Affected officers and staff were subsequently awarded payments of at least £7,500 each.
No Attacker, And It Is Still The Worst Kind
This corpus is largely a record of adversaries. This file has none. The mechanism was a spreadsheet published deliberately, by an organisation acting on a statutory duty, containing more than the person publishing it realised.
The desk records at 26-0802 that a quarter of its files cannot establish an entry route. Here the route is fully known and it does not help, because there was nothing to break. We filed the same category at 23-0512 and 23-0918, where exposure rather than intrusion did the damage.
In This Jurisdiction, A Name Is A Target
A rank-and-surname list is low-sensitivity data in most places. In Northern Ireland, officers routinely conceal their employment from neighbours and sometimes from extended family, and the threat to police from dissident republican groups is an operating assumption rather than a scenario.
Sensitivity is contextual, and no field in a data classification scheme captures this. We have recorded the same at 22-0118, where a register of separated families was dangerous precisely because those people were hard to find, and at 22-1024. The category of the data does not determine the harm; the situation of the person does.
The Remedy Was Money, Because Nothing Else Exists
A £750,000 regulatory fine and £7,500 per person is a substantial response by the standards this corpus usually records — 25-1031 documents settlements paying out far less against documented losses.
It also cannot do the thing that is needed. The information was copied within minutes and is not retrievable, and an officer who has moved house because of it has been made whole in no meaningful sense. The desk notes the payment as unusually serious and still files it under the argument it makes everywhere else: the remedy catalogue has one instrument and it is money.
Compiled from contemporaneous reporting, the ICO’s published statements, and subsequent reporting of the compensation scheme, listed below. The characterisation of the threat environment for officers in Northern Ireland is longstanding public context, not a claim specific to this incident. Arrests reported at the time are not carried: this desk names individuals only after conviction and no outcome is established here. Graded high. Corrections: corrections@forensicpost.com.