Andy Coulson, the Prime Minister and a disregard for national security and reputation.

The Guardian article on the lack of a proper security clearance for Andy Coulson whilst he was working for David Cameron after he became PM as isn’t quite at the level of Freddy Starr ate my hamster, but what should have been an excellent piece on how the Prime Minister had demonstrated a carelessness with the truth and disregarded the national security policy that is in place to protect the disclosure of information to those who are not authorised to have access to the information, came across more tabloid scandal than serious journalism.

It took three people to create that fluff piece and it substantially failed to critically examine the information provided to it by the government, the reporters also failed to understand how the process works and just why the issue is important on many levels.

The talking points are:

• The Prime Minister either hid his knowledge or did not know what security level Mr Coulson had been granted
• The PM showed a disregard for the HMG Security Policy Framework‘s (SPF) requirement that everyone be aware of the policy and how it applies.
• The PM demonstrated a lack of understanding of how the various clearance procedures worked, and
• ultimately the PM appears to have disregarded the Code of Conduct for Special Advisers and more importantly the SPF requirements.

The SPF states that

National Security Vetting
6. National Security Vetting is governed by HMG’s statement of policy, made by the Prime Minister to Parliament on 27 July 2010. There are three levels of National Security Vetting: Counter-Terrorist Check (CTC), Security Check (SC) and Developed Vetting (DV). The need for vetting must be assessed against the requirements of each particular post. Vetting is required for those who have unescorted access to sites or work in close proximity to individuals assessed to be at risk of terrorist attack, who have access to information or assets which may be of value to terrorists, or have constant and frequent access to SECRET and /or TOP SECRET information or other assets, including the protectively marked assets of other nations and international organisations, the compromise of which could bring about the same degree of damage.

my emphasis.

The Code of Conduct states:

3. The sorts of work a special adviser may do if their Minister wants it are:
i. reviewing papers going to the Minister, drawing attention to any aspect which they think has party political implications, and ensuring that sensitive political points are handled properly. They may give assistance on any aspect of departmental business, and give advice to their Minister when the latter is taking part in party political activities;

So the requirement for vetting as opposed to a Security Check is established by the scope of duties a special advisor may undertake and by Mr Coulson’s proximity to the PM who must, by the nature of his role, be considered the target for a terrorist attack and also because of his access to Downing St, which would also be a target (as it has been in the past) for a terrorist attack.

The PM of course can decide to waive any clearance requirement at his discretion as it’s his policy.

1. Ultimate responsibility for HMG security policy lies with the Prime Minister and the Cabinet Office. Departments and Agencies, via their Permanent Secretaries and Chief Executives, must manage their security risks within the parameters set out in this framework, as endorsed by the Official Committee on Security (SO).

The question is why he would waive the requirements for the vetting of Mr Coulson.  This clearance should have been undertaken as a matter of course, yet the PM waived this requirement. If the Cabinet Office are adhering to the SPF then this decision will have been documented in the risk register held by SIRO for the cabinet office. As of 30 June 2010 , this position was held by John Suffolk, Director General, Government Chief Information Officer.

Now, the PM insisted during questioning of his statement to parliament yesterday that an outside organisation undertook the clearance of Mr Coulson.  This is likely for a BPSS check (a basic pre-employment check of identity and references) but an outside organisation cannot undertake a Security Check.  All security checks and developed vetting is undertaken by the MoD and this would have been required when the government took office last year.

As the PM can accept any risks that he chooses and can override the SFP, the question arises as to why he didn’t say this yesterday.  His obfuscation and inconsistency in stating what level of clearance Mr Coulson had would lead an observer to believe that either the PM does not understand the basics of security policy as it applies to government and so is not demonstrating he is a fit person to handle sensitive information or was acting dishonestly to try to deflect attention.  Either way his judgement in both employing Coulson, waiving the requirement for a check (which he may in all likelihood have passed due to the scope of the check), not demonstrating a knowledge of basic security requirements for the position and the lack of information on what risk evaluation was undertaken does require answering.

My questions would be:

• What formal level of clearance does Mr Coulson hold?  This can be confirmed by the clearance email held by both Mr Coulson and the Cabinet Office.
• Why was the requirement for vetting not enforced for Mr Coulson?
• What informal clearance was granted and was this documented in the risk register as required by the SFP?
• Who took the decision not to expose Mr Coulson to the vetting process and for what reason?  Mr Coulson may have refused to undertake vetting and then it would be up to the PM to assess the risk and decide whether to allow him to continue to have access to sensitive details.
• Was Mr Coulson allowed access to sensitive information from foreign governments.  The SFP is very clear that vetting must be undertaken to uphold any agreements with foreign governments on the handling of sensitive material.  If he has had access to this material he has put the UK in breach of those agreements and could damage the reputation of the UK and the relationship between the UK and those countries.  This should be considered to be an extremely serious point.
• Why did the PM feel it necessary to not answer the question directly.

I wonder what other countries think about the fact that Mr Coulson had the ability to access protected information they had provided to the UK government with having been vetted as required by the agreements they have with the government.  I can’t see them being too pleased.

From the information given, it is quite reasonable to assume that Mr Coulson had the equivalent of a BPSS when he first went to work for the Conservatives and that when the party took office and the issue of vetting arose the David Cameron, in his role as PM, took the decision to accept the risk posed by not allowing vetting and ordered that he be treated as if he had a Security Clearance.  This serious deviation from the SFP does support the supposition that the PM was aware of the activities of Mr Coulson prior to his resignation from News International and undermines his claim that he was not aware of the allegations.

I certainly look forward to clarification from the Cabinet Office and the Prime Minister.