Still a high risk of cyber attacks in Leeds, report claims

A document discussed at the authority’s corporate governance and audit committee added that the risk of deaths, serious illness and economic slowdown due to coronavirus remains significant.

Leeds City Council’s annual corporate risk management report looks at the likelihood of negative incidents and trends over the coming year and the authority’s ability to deal with them.

It was claimed in the meeting that the risk of incidents was particularly high at the moment due to the Covid-19 pandemic, and that this was causing difficulties for the authority’s services.

This included the likelihood of cyber attacks on council computer systems, possibly compromising the confidentiality of the data of hundreds of thousands of Leeds residents.

The council, however, claims it has robust procedures in place to deal with the risks.

Council officer Tim Rollett told the meeting: “Over the last few months, we have seen a lot of these things happen.

“We can’t afford to take our eye off other things that may happen. This could be around Brexit, it could be prolonged adverse weather during the winter, and also what if there is another type of health pandemic such as flu?

“It is really important we keep our eye on the ball with this and not just focus on the big obvious one.

“Another risk is the financial risk to the council and the challenges around balancing our budget. These are incredibly challenging times and we are really being put to the test.

“But you could also say it’s a good time, because this is why we have the risk management arrangements and they appear to be standing up quite well at the moment.”

A “risk map” was also drawn up by the authority, which looks at the likelihood and possible severity of the risks. It concluded that an in-year budget deficit and the continuation of coronavirus were both “highly significant” and “almost certain” to happen.

Coun John Illingworth (Lab) said: “It is a bizarre situation where we can see obvious risks and would be foolish to ignore them, but we can’t do a great deal about it.

“The loss of income is an impossible situation that is not of our making.”

Mr Rollett responded: “We have do to as much as we possibly can to mitigate those risks, but no matter how much you do, there will always be something that could still happen.

“With those risks, we put in place controls and actions to manage those risks down as much as we can with the resources we’ve got.

“As we continue to manage the financial position of the council, those red risks should start to reduce. It’s too early to take them down just yet because there is a lot of work to do.”

According to the council’s corporate risk report, which was published in June, the council was putting systems in place to deal with the numerous risks the organisation faced over the coming year.

On Covid 19, it stated: “In Leeds, this has tragically resulted in fatalities and serious illness, significant disruption to the city – its residents, businesses and infrastructure – and to council services, with the consequences potentially greater for those more vulnerable or disadvantaged.

“Whilst many aspects of the risk have already materialised, there are still numerous uncertainties and at this stage it is hard to predict the full scale, or timing, of the impacts of Covid-19.”

It claimed coronavirus has seen the council take on extra costs while seeing its income from business rates and council tax shrink, adding that failure to deliver a balanced budget will mean the council has to consider “even more difficult decisions” on spending.

On the possibility of cyber attacks, it stated: “The council’s digital infrastructure is under constant attack from malicious sources attempting to disrupt the confidentiality, availability and integrity of our information or bring our systems and applications to a standstill, severely impacting our ability to deliver critical services.

“These risks require extensive management and treatment by the council.”