Outdated computer systems are putting police and fire services at risk of cyber attacks, a new report has warned.
HM Inspectorate of Constabulary and Fire and Rescue Services found that both sectors rely too heavily on legacy IT infrastructure and are not doing enough to address preventable human error, which increases their vulnerability to cyber threats.
Thames Valley Police said there are measures in place to protect against threats, while Oxfordshire County Council said the fire service has "robust" systems in place.
Michelle Skeer, head of the inspectorate, said: "Many police forces and fire and rescue services need to update their ICT systems to improve resilience.
"Leaders we spoke to in both sectors identified these 'legacy systems' as their highest strategic risk for cybersecurity.
"Modernising ICT across both sectors must become a priority.
"All the organisations we inspected relied on legacy systems to a greater or lesser extent."
The report also identified additional risks associated with third-party IT contractors, particularly those who handle sensitive police data.
Inspectors visited three police forces and three fire and rescue services in England and Wales as part of their review.
The report highlighted concerns about inadequate backup systems and insufficient measures to prevent human error.
Ms Skeer said: "It wasn’t just a lack of training and awareness that created opportunities for cyber attackers.
"In some of the organisations we inspected, we found poor security controls for staff joining, moving within and leaving the organisation.
"We also found poor password management and a lack of up-to-date approaches, such as multi-factor authentication.
"Some forces and services simply aren’t doing enough to prevent human error from increasing the risk of cyber attacks."
The inspectorate said senior leaders often rely on younger, less experienced IT staff to identify and communicate cybersecurity risks and solutions.
Ms Skeer said: "Underpinning all these problems is a leadership issue.
"Several senior police and fire leaders we interviewed told us that they didn’t consider cybersecurity to be part of daily operational decision-making.
"This has led to financial investment being directed to other more operational and tangible priorities."
The report made several recommendations, including ensuring all police forces and fire services meet baseline cybersecurity standards and improving the management of third-party contractors.
Inspectors also called for the creation of a national digital management centre for the fire service, similar to the one used by police.
A spokesman for Thames Valley Police said: "Like many organisations, Thames Valley Police is aware of the increasing threat of cyberattacks and our responsibility to do everything possible to mitigate against that threat.
"We have dedicated cyber security and ICT teams who proactively manage and respond to potential cyberattacks, working alongside national partners and other organisations in order to do so.
"We also work closely with third-party suppliers to ensure secure working practices are maintained.
“In addition, the force educates its officers and staff, in order to give them knowledge and skills needed to recognise and respond to security risks, including raising awareness of phishing and social engineering attacks.”
A spokesman for Oxfordshire County Council added: "Oxfordshire Fire and Rescue Service shares its IT service with Oxfordshire County Council.
"We have robust systems in place, which are constantly reviewed and updated."
Share