The National Law Enforcement Data Programme

Home Office

REPORT

by the Comptroller
and Auditor General

Session 2021-22

10 September 2021

HC 663

The National Audit Office (NAO) scrutinises public spending for Parliament and is independent of government and the civil service. We help Parliament hold government to account and we use our insights to help people who manage and govern public bodies improve public services.

The Comptroller and Auditor General (C&AG), Gareth Davies, is an Officer of the House of Commons and leads the NAO. We audit the financial accounts of departments and other public bodies. We also examine and report on the value for money of how public money has been spent.

In 2020, the NAO’s work led to a positive financial impact through reduced costs, improved service delivery, or other benefits to citizens, of £926 million.

We are the UK’s independent public spending watchdog.

We support Parliament in holding government to account and we help improve public services through our high-quality audits.

Ordered by the House of Commons
to be printed on 8 September 2021

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Gareth Davies
Comptroller and Auditor General
National Audit Office

20 August 2021

HC 663 | £10.00

© National Audit Office 2021

Value for money reports

Our value for money reports examine government expenditure in order to form a judgement on whether value for money has been achieved. We also make recommendations to public bodies on how to improve public services.

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.org.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

009266 09/21 NAO

If you are reading this document with a screen reader you may wish to use the bookmarks option to navigate through the parts. If you require any of the graphics in another format, we can provide this on request. Please email us at www.nao.org.uk/contact-us

This report can be found on the National Audit Office website at www.nao.org.uk

If you need a version of this report in an alternative format for accessibility reasons, or any of the figures in a different format, contact the NAO at enquiries@nao.org.uk

The National Audit Office study team consisted of:

Rob Cooper, Greg Hannah, Richard Lewis, Jonathan Pownall and Grace Williams, under the direction of Tom McDonald.

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

020 7798 7400

www.nao.org.uk

@NAOorguk

Key facts

Summary

1 The Home Office (the Department) manages two police information and communication technology (ICT) systems: the Police National Computer (PNC) and the Police National Database (PND), which both need replacing:

The PNC is the most important national policing information system in the UK. Since 1974, it has been the main database of criminal records. It is used by front-line officers from all 45 local police forces in the UK to understand who they are interacting with, as well as by 127 other organisations that need to access the data it holds. In 2019-20, the police searched or updated the PNC 133 million times, 93% of the total 143 million searches or updates.

The PND was introduced in 2011 following the Bichard Inquiry in 2004, which criticised police information-sharing and recommended that a national intelligence-sharing system be created. The PND makes more than 4 billion pieces of police intelligence available to licensed users in police forces and 18 other organisations.

2 The Department’s programme to develop the National Law Enforcement Data Service (NLEDS) was launched in 2016 to replace the PNC and the PND, which are reaching the end of their useful lives, and to enable the combined data to be linked to other systems. The programme is run by the Department with support from contractors, which have included BAE Systems, IBM and others.

3 In 2020, following increasing costs, delays and significant police concerns that the programme was not meeting their expectations, the Department decided to reset it. The Department removed the PND from the programme’s scope, adopted a new approach to delivering technology and set out its intention for the police to take a greater role in the programme’s development. The Department has extended contracts to maintain the PNC and the PND, and expects NLEDS to fully replace the PNC by 2025-26.

4 This report assesses the Department’s progress in delivering the NLEDS programme by 2020 (Part One), the need for the 2020 reset of the programme (Part Two) and the way forward (Part Three). Our audit approach and methodology are described in Appendices One and Two.

Key findings

The Department’s progress in delivering the NLEDS programme by 2020

5 Five years after the Department established the NLEDS programme in 2016, the programme is already overdue, has yet to deliver the expected services and the total costs to the Department have increased by 68% to £1.1 billion. The Department set up the programme to ensure business continuity by replacing the PNC and the PND, reduce costs, enable more innovative use of data and introduce a flexible system at the cost of £671 million. By 2020, when the Department decided to reset the programme, only part of the technology had been completed and an external review found that the system being constructed would be difficult to maintain and adapt, and included a component that was already obsolete. The Department told us that it had a high degree of confidence that a large proportion of the work produced before the programme reset could be reused. Under current plans, which are yet to be confirmed, the programme is not expected to deliver a service equivalent to the current PNC until 2025-26, more than five years later than its original planned delivery date of 2020. The Department expects that the new system will cost £17 million a year to run, less than the £21 million annual running cost of the PNC (paragraphs 1.6 to 1.7, 2.17, 2.20 to 2.25, Figure 7, 3.2 and 3.13).

6 The PNC, which NLEDS will replace, is vital to the everyday work of the police but is reaching the end of its life. Launched in 1974, the PNC is the primary database of UK criminal records, containing information about some 13 million people, 64 million vehicle records, plus driving licence-holders in England, Scotland and Wales. The police use data from the PNC when responding to an incident or during an investigation. It is considered part of the UK’s Critical National Infrastructure and is used by 172 organisations, including police forces. While generally reliable, the PNC is based on obsolescent technology that makes it expensive to operate and difficult to update, with a shortage of staff with the necessary skills (paragraphs 1.2 to 1.4, 1.7, 3.4, 3.7 to 3.8 and Figures 1 and 2).

7 The Department intended that the NLEDS programme would combine the PNC with the PND, which was over-optimistic given the time originally available, but has now decided that NLEDS will focus on replacing the PNC alone. The PND enables police forces to share intelligence that they have gathered locally. It was created in 2011 following the 2004 Bichard Inquiry prompted by the murder of two girls in Soham, Cambridgeshire, which criticised police information-sharing. In December 2020, the Department removed the PND from the scope of the NLEDS programme and it will now be maintained as a standalone system until 2031. The Department currently estimates that a refresh of the most critical elements of the PND will cost at least £13 million between 2021 and 2025 (paragraphs 1.5, 1.7, 1.13, 2.21 and 3.10 to 3.11).

The need for the 2020 reset of the programme

8 There have been multiple causes for the NLEDS programme’s poor performance in its first five years. An external programme review commissioned by the Department in 2020 found that, if the programme continued as it was, it would be late, difficult and costly to roll out and maintain, and it would not meet the needs of the police. The causes of delay have included uncertainty around the scope of the requirements, de-prioritisation of funding relative to other programmes, changes in technical approach, lack of commercial strategy and shortcomings in programme management and governance (paragraphs 1.12 to 1.15 and 2.2 to 2.22).

9 The Department and the police have not had a consistent shared understanding of the intended outcomes of the NLEDS programme. It has not been clear whether the programme aims to replace the functions of current ageing systems or to introduce enhanced capabilities for police and other users. The focus of the programme has changed several times (paragraphs 2.2 to 2.3).

10 Despite NLEDS’ importance to front-line police, the Department has not prioritised its funding relative to other law enforcement ICT programmes. The Department chose to prioritise for funding in preference to NLEDS, other major police programmes which were also delayed and increasing in cost. In 2019, the NLEDS business case noted that the larger Emergency Services Network programme and the smaller National Automatic Number Plate Recognition Service programme were both being prioritised over NLEDS. In every annual business case (2016 to 2019) the programme reported short-term funding shortfalls of up to £57 million. As a result of NLEDS delays, the police and other users will be required to fund £443 million (97%) of the increase in cost of the NLEDS programme and the extension of existing systems until NLEDS is delivered (paragraphs 2.5 to 2.7, 2.25 and Figure 3).

11 The Department changed several fundamental aspects of the NLEDS technology as the programme progressed, resulting in additional work and expenditure. The programme has switched its focus from replacing the PND and then the PNC to only replacing the PNC. Some suppliers and programme staff told us that there had been multiple changes of technical design, driven by differing advice as to what was state of the art. The Department’s decision to put data into the cloud meant that 82 security controls had to be designed and agreed, which took nine months. The programme found it harder than expected to transform data from the PNC to fit the data model used in the PND and proposed for the new system (paragraphs 2.17 to 2.22 and Figures 5 and 6).

12 The Department’s management of the NLEDS programme team, including multiple contractual relationships, produced a bureaucratic culture and inefficient development process. The 2020 external programme review concluded that the programme was oversized, poorly structured and inefficient. It found that the Department was not taking ownership of the technical development work and was overly dependent on contractors filling leadership roles, reducing its own control of the programme. The use of contracts based on fixed daily rates for most work exposed the Department to increased risks and did not incentivise improved supplier performance (paragraphs 2.10 and 2.14 to 2.16).

13 As a result of this delivery failure, during 2019 and early 2020, the Department attempted to reset the programme and commissioned several independent reviews. The Department began its first reset of NLEDS in early 2019. It also carried out reviews of the technical scope in 2019 and July 2020, and commissioned the external programme review of the programme’s overall deliverability in November 2020 (paragraphs 1.13 to 1.15, 2.4 and 2.13).

14 By autumn 2020, the police had lost confidence in the programme and, in response, the Department began a second ‘reset’, which is still being implemented. Senior policing stakeholders lost confidence in the Department’s ability to deliver a range of law enforcement technology programmes, including NLEDS, formally raising their concerns with the Department’s Permanent Secretary. In response, the Department appointed a new Senior Responsible Owner, restructured the programme team and developed a new business case and delivery approach for the programme. In 2021, the Department provided the programme with interim funding to start implementing the reset, but this funding only lasts until March 2022 (paragraphs 1.14 to 1.15, 2.4, 2.7 to 2.8, 3.12 to 3.14 and 3.18).

The way forward for the NLEDS programme

15 The Department’s failure to deliver NLEDS to date means that the increasingly fragile PNC system has not been replaced, bringing greater risks for police operations and requiring the police to bear more cost. Delays to NLEDS mean that the Department must continue to run existing systems, at a cost of £21 million per year for the PNC and £13 million for the PND. Between 1 January 2020 and 31 March 2021, excluding outages on systems run by the police, the PNC’s availability was 99.74%, exceeding the Department’s target of 99.65%. However, in January 2021, the PNC experienced a data loss affecting 112,697 person records. The Department’s efforts to recover the data lost were made more difficult by the ageing technology on which the PNC is based. Continuing to run the PNC also creates regulatory risk, because current police policy is to retain some data in the PNC until the person it relates to is 100 years old. The Information Commissioner’s Office (ICO) views the blanket application of a 100-year retention policy as risking being disproportionate in some instances (paragraphs 1.2 to 1.3, 2.24 and 3.2 to 3.9 and Figure 8).

16 The Department cannot yet guarantee to the police that a replacement system will be in place in December 2024, when the PNC’s current technology will no longer be supported. As of April 2021, the Department had only ‘moderate confidence’ in its new plans and did not have a programme plan assuring delivery by 2025-26. The Department told us that it had decided to accept the risk of running the PNC without support for the database after 2024. If there are further delays to the NLEDS programme, the Department may also need to migrate the PNC to a new operating system, which could take three years and cost at least £30 million. The Department told us in June 2021 that it had increased confidence in the deliverability of the programme (paragraphs 3.5, 3.13 and 3.18).

17 The operational independence of UK police forces is a key challenge for the Department’s implementation of national law enforcement programmes such as NLEDS. UK police forces are independent of central government, which means that the Department does not generally direct the police to accept a particular ICT system or way of working. Each police force is responsible for establishing what local ICT systems it requires, and then procuring and maintaining them. There are no police bodies that can run major national programmes on behalf of all forces. The police ICT landscape is complex, and transition to NLEDS cannot be achieved just through deploying new technology. It will require the police to adapt their systems and business practices (paragraphs 1.8 to 1.10 and 3.23 to 3.26).

18 The Department recognises the importance of regaining the confidence of the police but it is too early to assess the results of its new approach. The programme team has sought to rebuild stakeholder confidence that it can deliver and to work more collaboratively with the police. To better align the programme with police requirements, a new ‘product owner’ approach has been adopted, which embeds a police representative within a development team to agree on priorities and make decisions on behalf of police users. The programme’s senior police stakeholders expressed increasing confidence in the programme’s developing delivery plans (paragraphs 3.15 to 3.18).

Conclusion on value for money

19 Between 2016 and 2020, the Department did not achieve value for money against its plans to deliver NLEDS. The Department did not deliver the programme by its original timetable of 2020. This meant that the police and other public organisations had to continue to use legacy systems, which limits their ability to deliver crucial national requirements, including aspects of public safety. The delay has meant additional costs for the Department, the police and other users, to maintain legacy systems alongside the development of the new service. It is not yet clear how much of the work done prior to 2020 can be reused under the programme’s new approach and how much has been wasted.

20 The Department believes that its decision in 2020 to reset the programme will provide a more realistic approach to delivery. The Department is still developing its plans and these do not yet set out the full range of services that will be delivered for the police or when they will be available. The Department has not yet demonstrated that the NLEDS programme will be able to replace the PNC’s capabilities by December 2024 and it now plans to run this part of the Critical National Infrastructure using a database without full support for at least a year. The Department, therefore, still faces significant risks in delivering the reduced scope, particularly around police engagement, and many practical challenges remain.

Recommendations

21 The Department should:

a Clarify immediately the respective roles and responsibilities of the Home Office and the police for delivery of the new service, particularly on decision-making authority at key stages.

b Agree a revised business case for the programme that covers its whole lifecycle, with central government stakeholders and funders including the police.

c Set out a clear programme plan, including delivering the first product to the police during 2021, and outline plans beyond that which demonstrate how NLEDS will replace the PNC’s capabilities in the time required (by 2025-26). It should also include the key dependencies for the programme’s delivery, particularly how police forces will transition from the PNC to NLEDS.

d Produce plans setting out how it will guarantee a continuing PNC service that the police can rely on until NLEDS is ready, including a full assessment of the risks of continuing to run the PNC and contingency plans for failure. This plan should include a review point at which the decision to replace the PNC’s operating system can be taken promptly.

e Monitor its technical capability and skills to deliver the programme, and urgently address any shortfalls.

f In procuring new suppliers, consider carefully the balance of risks and incentives between the Department and suppliers, and how it will integrate the work of different suppliers, in order to deliver the new services to an assured timetable.

Part One

The Department’s progress in delivering the NLEDS programme by 2020

1.1 This part sets out why the police need national information systems, what the National Law Enforcement Data Service (NLEDS, or the programme) is, why it is needed and the Home Office’s (the Department’s) progress in delivering it before the programme reset in 2020, including the costs incurred.

Police national information systems

1.2 The police need timely access to accurate information about persons of interest, vehicles and events, 24 hours a day. For example, call handlers in police control rooms and police officers make use of information about individuals to assess risks when responding to emergency calls. Investigators will use the information to establish connections between suspects, vehicles, prior incidents and property. This information may be accessed via control rooms, from a mobile device or at a desk in a police station. The two primary sources of national information for the UK police are the Police National Computer (PNC) and the Police National Database (PND) (Figure 1).

1.3 The PNC is the most important national policing information system in the UK. It is vital to the everyday work of the police and is considered part of the Critical National Infrastructure.1 Launched in 1974, the PNC is the primary database for UK criminal records, holding information on over 13 million individuals. It also holds details of every licensed driver and vehicle in England, Scotland and Wales. The police use data from the PNC when responding to an incident or during an investigation (Figure 2).

1.4 The PNC is used by 45 UK local2 police forces and 127 other public and private organisations, including the National Crime Agency, the Disclosure and Barring Service and credit reference companies. Police forces account for the overwhelming majority of use of the PNC, making up 93% (133 million) of the total 143 million transactions (searches and updates) in 2019-20. The PNC connects to various other police information systems including the Violent and Sex Offenders Register (ViSOR). The Department provides the PNC central system and the network that links it to police forces’ local networks. The stored information remains the responsibility of the police forces and other organisations that provide and own it.

1.5 The PND enables police forces to share intelligence that they have gathered locally. It was created in 2011 following the Bichard Inquiry in 2004 prompted by the murder of two girls in Soham, Cambridgeshire. The inquiry criticised police information-sharing and recommended that the government develop a national intelligence database. The PND holds information about people, objects, locations and events, and enables analyses of these data. It contains over 4 billion pieces of information including records of organised crime, safeguarding issues and domestic abuse. Some of the information held on the PND is therefore sensitive and access is accordingly more restrictive than for the PNC. As well as police forces, 18 other organisations (such as the Disclosure and Barring Service and the ACRO Criminal Records Office) provide data to the PND or access it.

The need for change

1.6 In 2014, the Department recognised that the PNC and the PND were reaching the end of their useful lives and needed replacement. The PNC, while generally reliable, is based on obsolescent technology, which makes it expensive to operate and difficult to update, with a shortage of staff with the necessary skills. While newer, the PND also required a technology update. The Department believed a replacement would bring operational benefits by enabling combined PNC and PND data to be linked to other existing systems and those being developed, such as the Home Office Biometrics and the National Automatic Number Plate Recognition Service programmes. Police stakeholders’ primary requirement was to introduce any replacement with minimal disruption to their operations.

1.7 The Department and the police both saw the achievement of cost savings as a key benefit of replacing the existing systems, with a predicted reduction in annual operating costs from £37 million to £20 million (46%) per year. The contracts for the PND and the PNC were due to end in March 2019 and December 2020, respectively. In 2016, the Department approved the NLEDS programme to develop a new system. It intended that the NLEDS system would combine the data held on the PNC and the PND, providing a single point of search to users, integrating criminal records and intelligence information to enhance police effectiveness, and reducing the time required to gather relevant information. The new system would also enable the sharing of images, provide the ability to receive alerts when new data were available and host a national missing persons register. The approach chosen was described as “ …[the] minimum scope initially... ”. The Department considered extending the programme to include other services, such as automatic number plate recognition and borders and immigration data. When the NLEDS programme began, the new service was expected to replace the PNC by March 2020.

Delivery of national policing ICT programmes

1.8 The challenge of developing and introducing police technology systems is a long-standing one. UK police forces are independent of central government, meaning that the Department does not generally direct the police to accept a particular information and communication technology (ICT) system or way of working.3 Each police force is responsible for establishing what local ICT systems it requires, and then procuring and maintaining them.

1.9 While the 45 local police forces across the UK have a common goal of public safety and crime prevention, each has its own processes and procedures. This creates complexity in identifying and agreeing user requirements and programme constraints, and there is no single police stakeholder who can provide an agreed and consistent user perspective. Historically, the police have attempted to address this issue by creating coordinating bodies. Currently, this role is filled by a committee of the National Police Chiefs’ Council (NPCC), which the police created to better coordinate the procurement of ICT systems.4 The chair of this committee (the Commissioner of the City of London Police) is a member of the NLEDS programme board where he acts as the lead police representative.

1.10 The police have also created a team to articulate their needs to the Department’s ICT programmes. There are no police bodies that can run major national programmes on behalf of all forces. In 2015, the NPCC created the Operational Communications in Policing Team (OCiP) to ensure effective police representation in the programme to deliver the Emergency Services Network (ESN). The police subsequently expanded the remit of OCiP to include NLEDS, where it has responsibility for ensuring that police requirements are taken into account by the programme team and that police forces take advantage of the opportunities offered by NLEDS. OCiP supports a number of Chief Constables’ Reference Groups, which provide high-level guidance and insight into police needs to the Department’s national ICT programmes for police use. The Chief Constables’ Reference Group for NLEDS is chaired by the Commissioner of the City of London Police.

1.11 The Department is delivering several other national ICT programmes for police use, in addition to NLEDS, and needs to work closely with the police on all of them. The portfolio of programmes includes ESN, Home Office Biometrics and the National Automatic Number Plate Recognition Service. In 2020-21, these programmes cost £656 million, of which the majority (79%) related to ESN. Around three-quarters of the cost of these programmes is ultimately borne by the police, and other organisations will also pay to use the systems being constructed by the Department.

NLEDS’ development before 2020

1.12 The Department originally intended that the NLEDS programme would design, build and deliver a new system to replace the PNC and the PND. The existing systems would be decommissioned by 2020 as police and other users transitioned to the new system.

1.13 By early 2018, the Department had recognised that the programme would not deliver as originally planned. It had underestimated the amount of work required and the effort remaining was unaffordable within the allocated budget. In June 2018, the Infrastructure and Projects Authority (IPA) reviewed NLEDS and concluded that delivery of the programme appeared to be unachievable.5 The Department began its first reset of NLEDS in early 2019.

1.14 Despite the Department’s attempt to reset the programme in 2019, the police continued to have concerns about progress. In September 2020, the programme’s Chief Constables’ Reference Group stated that a failure to deliver against a proposed second reset would result in a formal withdrawal of consent for NLEDS from the police service. This was reinforced in October 2020 when the NPCC wrote to the Department’s Permanent Secretary stating that the police had lost confidence in the Home Office’s ability to deliver a range of law enforcement technology programmes, including NLEDS.

1.15 At the same time as these interventions, the Department commissioned an external programme review of NLEDS. This review concluded that the programme “most likely” would experience further delays; not be fit for purpose; deliver limited value to the police causing disruption on its introduction; and would not deliver value for money. Part Two of this report examines the causes of the problems. Part Three assesses the Department’s second reset of the programme in December 2020 and the way forward following this.

1 The UK Government’s official definition of Critical National Infrastructure is: “Those critical elements of infrastructure (namely assets, facilities, systems, networks or processes and the essential workers that operate and facilitate them), the loss or compromise of which could result in: a) Major detrimental impact on the availability, integrity or delivery of essential services – including those services whose integrity, if compromised, could result in significant loss of life or casualties – taking into account significant economic or social impacts; and/or b) Significant impact on national security, national defence, or the functioning of the state.” Centre for the Protection of National Infrastructure, www.cpni.gov.uk/critical-national-infrastructure-0

2 This includes the 43 ‘territorial’ or geographically based police forces of England and Wales, plus Police Scotland and the Police Service of Northern Ireland. Other police forces such as the British Transport Police also use the PNC.

3 Under the Police Act 1996, section 57(3), the Secretary of State may make regulations requiring police forces to use specific facilities or services, if they consider that it would be in the interests of the efficiency or effectiveness of the police. The Act covers police forces in England and Wales.

4 The Information Management and Operational Requirements Coordination Committee (IMORCC).

5 The IPA rated the NLEDS programme as red, which it defines as: “Successful delivery of the programme appears to be unachievable. There are major issues which, at this stage, do not appear to be manageable or resolvable. The programme may need re-baselining and/or overall viability re-assessed.”

Part Two

The need for the 2020 reset of the programme

2.1 This part assesses the causes of the Home Office’s (the Department’s) failure to deliver the National Law Enforcement Data Service (NLEDS, or the programme) to the originally expected timetable, including the programme’s objectives and scope, its funding, programme management and governance, the commercial approach and the approach to data and technology. The part concludes with an overview of the Department’s forecast cost of NLEDS.

Programme objectives and scope

2.2 The Department and the police have not had a consistent shared understanding of the intended outcomes of the NLEDS programme. The Department and the police documented the ‘vision’ for the programme in September 2018, almost two years into its development. Our previous work on government’s major programmes has shown the importance of a programme’s scope being clearly aligned with its strategic objectives.6

2.3 The Department’s original intent for the programme was to replace both the Police National Computer (PNC) and the Police National Database (PND), and to provide the police and other organisations with enhanced functions such as combined data from both systems and alerting users to updated information. The Department intended to ensure business continuity by replacing the PNC and the PND, and to reduce costs. The programme’s exploratory work found that the police had a different view of what was needed, primarily focused on reducing costs and replacing the existing systems with minimal change. Since 2016, the Infrastructure and Projects Authority (IPA) has repeatedly reported a lack of consistency in stakeholders’ understanding of the programme’s scope, approach and benefits.

2.4 In the first programme reset in January 2019, the Department decided to focus on replacing the PNC first and then discovered that, because of the age and complexity of the PNC, developing requirements for a replacement system would need more work than planned. As programme delays and costs increased, the Department sought to reduce the scope of what was being delivered. It conducted an internal technical review in July 2020, which concluded that a system that replicated the current PNC’s functions without any enhancements would reduce the effort to complete without reducing benefits. The Department asked police stakeholders to compromise on the need for several requirements. Police representatives agreed to some reduction in scope but were concerned about potential deferrals or further reductions that might mean that NLEDS would provide less capability than the PNC. These concerns ultimately contributed to the police’s loss of faith in the Department’s ability to deliver a range of law enforcement technology programmes. In November 2020, an external programme review of the programme found that there was still “a lack of aligned vision” between the Department and the police and that addressing this was critical to the success of the programme.

Funding

2.5 The NLEDS programme has suffered from shortfalls in Department funding throughout its development. The Department has required NLEDS to request funding in a series of annual business cases. Every business case for NLEDS, from 2016-17 to 2019-20, noted that the funding allocated to the programme was insufficient to cover the cost requirement and that the programme would have to take action to reduce its forecast. These funding shortfalls ranged from £9 million in 2016-17 to £57 million (45% of the funding required) in 2018-19 (Figure 3).

2.6 The Department chose to prioritise other major police programmes, which were also delayed and increasing in cost, for funding in preference to NLEDS. In 2019, the NLEDS business case noted that the larger Emergency Services Network (ESN) programme7 and the smaller National Automatic Number Plate Recognition Service programme were prioritised over NLEDS. It described the NLEDS funding as the “…balancing item…” in the Department’s portfolio of law enforcement programmes, requiring “…budgets to be stretched to meet the affordability constraints, with an inevitable impact on timelines.”

2.7 The programme currently only has interim funding until March 2022. The 2021 business case for the reset noted that no funding was allocated to the programme from 2022-23 onwards. No business case had been submitted in 2020. In 2021, the programme was granted interim funding to start implementing the reset.

Programme management and governance

2.8 The Department established a dedicated team of staff for NLEDS, headed by a programme director. A Department director was the Senior Responsible Owner (SRO) for the programme. Both the programme director and the SRO were in post from the start of the programme in 2016. The Department appointed a new SRO in October 2020.

2.9 The former SRO for NLEDS also held the SRO role for two other major Department programmes for the police, including the larger ESN programme that started at a similar time to NLEDS and has also faced significant challenges. The Department has told the Committee of Public Accounts in Parliament that it is moving to a model where SROs should only have responsibility for one major programme.8 In line with this, the current SRO is accountable for only one major programme, NLEDS. His other responsibilities include the smaller National Automatic Number Plate Recognition Service programme.

2.10 The November 2020 external programme review found that the NLEDS programme team was oversized, poorly structured and inefficient. In late 2020, the programme team comprised around 300 people, organised into multiple teams consisting of civil servants and staff from various suppliers. Each team worked on broad facets of NLEDS delivery, such as security or testing. The review found that teams had not been empowered to make significant decisions or take responsibility for delivering the programme as a whole. It noted that “There appears to be a lot more effort spent talking about, measuring and documenting work than is spent actually writing code.” As part of the programme reset in late 2020, the programme team was reduced to around 60 staff.

2.11 NLEDS has a programme board to oversee progress and support the SRO in providing assurance to the Accounting Officer, the Department’s Permanent Secretary. The board, attended by around 20 people, is chaired by the SRO and is the main way for the police to provide input and understand progress. Since 2019, the board has met every two months, less often than the boards for some other major Department programmes.

2.12 The programme board has not always had the management information it needs. A 2018 review found that the programme teams did not have a consistent process to record and report on the risk of development work taking longer than expected. From September 2019, the board did receive some data on progress that indicated that the development team was completing an average of 7% less work per three-month period than expected. Still, the impact was not appreciated or discussed until August 2020, when the board papers noted that the cumulative delay meant that NLEDS could not be delivered before the PNC was due to be decommissioned.

2.13 The Department’s governance and assurance processes identified that the NLEDS programme needed its first reset, which took place in 2019. The programme regularly reports to Departmental boards and the Department’s digital, data and technology function. The programme has previously commissioned several reviews that raised many of the issues in this report, while the IPA also raised concerns, but the Department has continued to approve business cases that reported increasing costs (paragraph 2.23) and delayed delivery.

Commercial approach

2.14 The programme has multiple contracts but has never created a commercial strategy to explain how they will be made to work together or the rationale for the chosen approach. The main contracts were based on fixed day rates for staff (‘time and materials’). This approach does provide some flexibility to change suppliers and it avoids needing to set a total price in advance. However, it also means that limited responsibility is passed to suppliers, there are no formal contractual mechanisms to incentivise delivery and the Department is exposed to greater risks.

2.15 To make the chosen approach work, the Department would need to manage all its suppliers to ensure that they work together to deliver the programme, while also controlling cost. The November 2020 external programme review found that the Department was over-reliant on suppliers filling leadership roles and was not taking sufficient ownership of the technical development work. It found that the Department had limited ability to control how suppliers worked together, that code being produced was often poor quality, and that the development process was bureaucratic, with suppliers working in disconnected teams communicating with each other via support tickets rather than working collaboratively.

2.16 The two biggest contracts were with BAE Systems (‘BAE’), appointed in 2016 to provide the overall technical design; and IBM, appointed in 2017, a year after the programme began, to do the majority of the development. Since 2018, programme business cases have stated that the programme team wanted to strengthen civil servants’ contribution to NLEDS development. The Department also aimed to move to a new model for contractor involvement, with a ‘systems integration delivery partner’ owning and managing the delivery of NLEDS. The Department began a procurement for this role in early 2020 but paused it because of the COVID-19 pandemic. Before the programme reset, there were multiple other contracts (Figure 4) and the programme’s commercial team was supporting 15 re-procurements every year, as well as managing 30 active contracts.

Data and technology

2.17 The programme has yet to deliver the expected services for police and other users. After five years of development, nothing has been delivered into live usage across all police forces. The programme has supported a trial and ongoing roll-out of a Driver & Vehicle Licensing Agency (DVLA) system where the police can access a driver’s photograph from their DVLA record at the roadside. This uses DVLA data and interfaces developed outside the programme. The programme has a prototype web application that can display test data but it is not yet connected to any real data. The programme also helped develop protocols for storing police data in the cloud and these are being adopted by other programmes including the Home Office Biometrics programme.9

2.18 This lack of delivery has been due to:

the inherent complexity of managing data securely, and combining the data from the PNC and the PND; and

the programme making many changes to what it was focusing on and changing the technical components used, requiring rework.

Managing data

2.19 The programme found it difficult to meet the security requirements set by the police. The data in the PNC are generally not regarded as highly sensitive but about 10% of police searches are for data that require additional security controls. The Department’s decision to put data into the cloud meant that 82 security controls had to be designed and agreed, which took nine months.

2.20 Until 2021, the programme was trying to transform the PNC data to be compatible with the data model used in the PND. A common data model would allow the police to better search across the data in the two systems NLEDS replaces, but the two sets of data are structured differently. The PND data model, called ‘POLE’ (Persons Objects Locations Events), requires data to be joined up. For example, in the PND, data on ‘events’, such as criminal activity and intelligence reports, are used to create links between the ‘persons’, such as suspects or victims, and the ‘locations’ where the events occurred. PNC data have very few linkages recorded and the PNC does not have the PND’s concept of ‘events’. Adding additional linkages into the data in the PNC so that it could be compatible with the POLE model proved more difficult than the programme expected.

Technical approach

2.21 The programme was not consistent in how it focused its development work. Instead of working to a clear plan for building a new capability, development work was reactive and influenced by which contract was ending first (Figure 5):

In 2016, the programme intended to replace the PND first, before its contract would end in 2019, with the PNC to be decommissioned by 2020.

By 2018, delays meant that the PND contract had to be extended to 2021 and the programme decided to focus on replacing the PNC first before the mainframe reached its end of life in 2020.

In 2019, the programme lacked the funding to replace both systems (paragraph 2.5) and decided to make the replacement of the PND optional, pending a decision to be taken in 2020.

In 2021, the Department removed the PND from the scope of NLEDS entirely and the programme is now focused on the replacement of the PNC.

2.22 There have also been several changes of technical design requiring rework. Changes ranged from the choice of specific components, such as the database, to the overall design and approach, which changed multiple times (Figure 6). Some suppliers and programme staff told us that these changes arose from different opinions and advice from Departmental digital leaders as to what was ‘state of the art’. By 2020, when the Department decided to reset the programme, only part of the technology had been completed. The November 2020 external programme review found that the system being constructed would be difficult to maintain and adapt in future, and included a component that was already obsolete. The Department told us that it had a high degree of confidence that a large proportion of the work produced before the programme reset could be reused. This would include documentation on requirements, governance structures and processes, operating models and security controls.

The costs of NLEDS, the PNC and the PND

2.23 In 2016, when NLEDS was started, the Department forecast that it would spend £671 million (in 2021-22 terms). This included the costs of building and running NLEDS, and the costs of running the PNC and the PND until NLEDS replaced them. Following delays to the programme, the total forecast cost to the Department has increased by £457 million (68%) to £1.1 billion (Figure 7). This comprises the estimated total cost of the NLEDS programme (£416 million), running the new systems until 2036 (£216 million), running the PNC until it is replaced (£236 million) and continuing to run the PND (£260 million). These costs are the Department’s March 2021 estimate and are subject to further revision as it develops its new approach.

2.24 When complete, the March 2021 estimate shows that NLEDS should still save money for the taxpayer. It shows that the PNC costs £21 million a year whereas NLEDS is expected to cost £17 million. The Department has not yet reforecast the future cost of continuing to run the PND but, in 2019, the programme estimated that the PND would cost £13 million a year to continue to run. In total, the Department expects to pay £30 million to run NLEDS and the PND instead of £34 million a year to run the PNC and the PND, a saving of £4 million a year (12%). This is lower than the 46% saving expected in 2016 (paragraph 1.7) when NLEDS planned to replace the PND as well as the PNC. The Department also expects NLEDS to produce considerable efficiency savings for law enforcement, which it is working with the police to estimate. These savings will depend on how the police adopt and use the new service, which is not yet known.

2.25 The programme recovers around 97% of its cost from the police and other users, so the NLEDS users will ultimately pay £443 million for the cost overruns. It expects to recover some 91% of the build cost from the police grant (‘top-slicing’), and all the running cost via a mechanism known as the ‘Memorandum Trading Account’ (MTA). The MTA is also used to recover the cost of running and maintaining the PNC and the PND, so delays in the programme have a direct impact on police budgets because they must pay to continue running legacy systems, as well as a share of the increased costs of NLEDS.

6 Comptroller and Auditor General, Lessons learned from major programmes, Session 2019-21, HC 960, National Audit Office, November 2020.

7 Comptroller and Auditor General, Progress delivering the Emergency Services Network, Session 2017-19, HC 2140, National Audit Office, May 2019.

8 Public Accounts Committee oral evidence: Digital services at the border, HC 936, 1 February 2021, Q66.

9 Definition from the NAO publication Guidance for audit committees on cloud services (April 2019): “The ‘cloud’ is a term for using the internet to access systems and data stored outside an organisation’s own premises. It can be thought of as an evolution of outsourcing IT provision although cloud solutions also introduce new contracting models.”

Part Three

The way forward for the NLEDS programme

3.1 This part examines the consequences of the Home Office’s (the Department’s) failure to deliver the National Law Enforcement Data Service (NLEDS, or the programme) on time, including the implications for continued use of the Police National Computer (PNC) and the Police National Database (PND). It also outlines the future direction of the NLEDS programme and the risks to its successful completion.

Consequences of the failure to deliver NLEDS on time

PNC performance

3.2 The Department had intended to deliver NLEDS before the main contracts for the PND and the PNC expired, in March 2019 and December 2020 respectively. The failure to deliver the programme on schedule means that, under current plans, the Department, the police and the wider user community will be reliant on the existing systems until at least the mid-2020s. The contracts have had to be extended. Further problems arising from any of the issues set out here could have a serious impact on the police and other users, and force the Department to amend NLEDS to respond to a different timetable.

3.3 Continuing to rely on the PNC poses several risks to the Department and the police. Following a major data loss from the PNC (Figure 8) in January 2021, the Department commissioned two reviews to identify the causes of the incident and the lessons to be learned. The reviews found that the risks associated with the PNC included:

obsolescent system technology;

capabilities and skills; and,

management and process failures.

Obsolescent system technology

3.4 Part of the Department’s rationale for the NLEDS programme is that the technology on which the PNC is based is obsolescent. This makes it harder to implement changes and to maintain the system. The Department’s efforts to recover the data lost in the January 2021 incident were made more difficult by the ageing technology on which the PNC is based.

3.5 To maintain the PNC to 2025 and beyond, the Department will need to replace key components of the PNC even though the whole system will be replaced by NLEDS:

The Fujitsu mainframe computer used by the PNC will reach the end of its supported life by 31 December 2021. In March 2021, the Department signed a contract with Fujitsu for a new mainframe that could last until 2026, costing £9 million. The Department is already the only UK customer for the model used.

The Software AG database used by the PNC is only supported on the Fujitsu mainframe until 31 December 2023. The Department has an option to extend the contract for this support for a further 12 months but it has not yet agreed this with the supplier. If NLEDS is not ready, the PNC will need to be moved off the mainframe onto a supported operating system from 2025 or run unsupported. The Department told us that it had decided to accept the risk of running the PNC without support for the database for 12 months after December 2024. This would leave the PNC at higher risk of disruption for at least a year, although the Department’s view is that the actual risk profile is low because of the mitigation actions put in place. Moving the PNC to a new operating system could take three years and the Department estimates that it will cost at least £30 million (to be reduced by potential savings of £4 million per year in running costs). Moving risks disrupting the PNC because some PNC code will need to be rewritten to work on another operating system.

3.6 Despite its age, the PNC has met the availability target set by the Department. The Department monitors the availability of the mainframe, data centre and the main network for the PNC, but not the availability of police forces’ local or regional networks through which they access the PNC. Between 1 January 2020 and 31 March 2021, the Department’s data show that the PNC was available 99.74% of the time, exceeding the Department’s annual target of 99.65%. These data exclude planned outages. For example, the mainframe must be taken down for more than two hours for regular periods of planned maintenance. Including planned outages, availability was 99.49%. On 5 March 2021, the PNC was unavailable for six hours due to a network issue. These data do not include any outages of networks or systems owned and run by the police.

Capabilities and skills

3.7 The obsolescent nature of the PNC’s technology requires specialist skills and experience to maintain it. The Department employs a team that keeps the PNC available and up to date. The PNC is based on 1970s technology and the complex way it has been developed over the decades means that the Department is dependent on this expert team for the continued operation of the PNC. Key staff on the team are approaching retirement but the specialist knowledge requirements to maintain the PNC make it difficult for the Department to recruit and train replacements.

Management and process failures

3.8 The scarcity of the necessary knowledge and skills makes it harder for the Department to manage and update the PNC. Changes made to the PNC are governed by a formal process of approval and assurance. However, the independent review of the data loss incident found that, while it resulted from a single coding error, the processes and culture that existed within the PNC team had led to this mistake affecting the PNC database. The independent review concluded that a lack of staff turnover within the PNC team resulted in complacency around assurance processes, with managers lacking the expertise to challenge the team’s work.

Other risks

3.9 Continuing to run the PNC also creates regulatory risk. The Data Protection Act 2018 requires personal information to be kept for no longer than is necessary. Current police policy is to retain some data in the PNC until the person it relates to is 100 years old. The Information Commissioner’s Office (ICO) views the blanket application of a 100-year retention policy as risking being disproportionate in some instances, particularly in arrest-only and no further action cases. The ICO told us that they understand from conversations with relevant stakeholders that the PNC’s age meant it would be difficult to implement a different policy. The ICO has been informed that NLEDS offers a digital solution to address the issues that the PNC poses. The ICO told us, however, that the increasing delays in migrating the data to NLEDS pose a barrier to addressing the data protection concerns that may have an impact on the ICO’s approach to this issue. The Department and users of NLEDS will need to ensure that the new system complies with relevant laws and regulations, and that safeguards are put in place for appropriate collection and usage of data.

PND impact

3.10 In late 2020, the Department decided not to replace the PND as it had planned. Following the November 2020 independent programme review of NLEDS and the second programme reset, the Department excluded the replacement of the PND from the scope of NLEDS. It did so to reduce the technical complexity posed by merging the two systems, to reduce costs and to fully prioritise the replacement of the PNC. Initially, therefore, police and other users will be unable to access PNC and PND data from a single system, which was one of the Department’s original objectives for NLEDS. The Department intends that PND information will be accessible through NLEDS at a later date but this has not yet been determined.

3.11 The PND will now be maintained as a standalone system until 2031. It was introduced in 2011 and, as technology and police requirements have evolved, the system has required updating. The intention to integrate the PND and the PNC under NLEDS led to the Department repeatedly deferring upgrades to the PND because the new system would make it unnecessary. This repeated deferral of investment means that some elements of the PND’s infrastructure have reached the end of their service lives, affecting both service quality and stability. The Department estimates that a refresh of the most critical elements of the PND will cost at least £13 million between 2021 and 2025.

Future of the programme

3.12 Following the November 2020 external programme review (paragraph 2.4), the Department has been undertaking a reset of the NLEDS programme, starting in late 2020. As part of the reset, it has restructured the programme team and produced a business case for formal approval of the new approach. The Department also plans to:

improve the way it works with the police;

change the way it develops technology;

appoint new suppliers to deliver technology; and

ensure that users have more choice about how they transition to NLEDS.

3.13 The Department has begun work on all these aspects of its new approach but acknowledged in April 2021 that it had only ‘moderate confidence’ in its new plans. The Department did not have a programme plan providing assurance of delivery by its target date of 2025-26, which is more than five years later than its original delivery date of 2020. The Infrastructure and Projects Authority (IPA) reviewed the programme in April 2021 and found that “ … encouraging progress is being made in the reset, but much remains to be done to fully establish the deliverability of the programme.” The Department told us in June 2021 that it had increased confidence in the deliverability of the programme. The IPA undertook a further review of the programme in July 2021 and gave it an amber rating.10

Producing a new business case

3.14 The Department approved a business case for the new approach in July 2021. The programme team had been developing the business case since February 2021 and the Accounting Officer had decided that approval for the programme to continue would only be given when the new business case was approved. The programme postponed approval from April 2021 to July 2021 to give the police time to formally agree to the new approach. In July, the Accounting Officer reviewed the programme and concluded that it should proceed. He also noted that the programme should focus in particular on three areas in the next phase of delivery: technology, engagement with the police and resourcing. Now the business case is approved, the programme expects to submit a new business case every six months, starting in early 2022. Digital leaders in government have told us that the business case process does not work well for digital programmes because it locks in assumptions too early.11

3.15 The programme team has defined 12 ‘critical success factors’ to measure progress resetting NLEDS. In June 2021, eight of these were rated as green, three amber and one red (Figure 9). A green rating does not mean that the underlying issue is resolved, only that progress is being made. The red rating, for ‘people to deliver’, related to expected vacancies in the NLEDS programme team and a dependency on key people in the PNC team. The programme has sought to rebuild stakeholder confidence that it can deliver and also to work more collaboratively with the police. The programme’s senior police stakeholders told us that their support, which the Department has rated green, depends on the programme starting to deliver usable technology, for which the relevant ratings are amber. They expressed increasing confidence in the programme’s developing delivery plans. In July 2021, the Department’s internal reporting suggested that it was making progress against these critical success factors, with seven of the eight that were green marked as ‘met’; ‘constraints removed’ remaining green; ‘people to deliver’ moving from red to amber; and the rest remaining amber. The four rated amber were not seen as preventing the programme moving forward.

Improving collaboration between the Department and the police

3.16 As well as considering how to work more effectively with the police on NLEDS, the Department is developing a new approach to collaborating with the police across its technology programmes portfolio. This approach will emphasise the gradual development of new systems, with the police providing guidance and feedback throughout. The full implementation of this new approach is still being agreed with the police.

3.17 The Department has made NLEDS a pilot programme for the new approach to working with the police. This ‘product owner’ approach embeds a police representative within a development team who will agree priorities and make decisions on behalf of police users. The first ‘product owner’ is a chief inspector who holds the role for the ‘property’ product. At the time of this report, it is too early to assess the results of this new approach. In an April 2021 review, the IPA noted that much more work was needed to ensure that both the Department and the police had a shared understanding of how the NLEDS programme will be delivered over the remaining life of the programme.

Delivering the NLEDS technology

3.18 The programme now plans to deliver NLEDS technology in smaller self-contained ‘products’ rather than all at once. The Department believes the new approach will help it to meet the police’s needs and that the result will be easier to maintain. The Department does not intend to produce a detailed plan of what products it will make or when they will be completed but told us that it would work flexibly with the police to agree priorities and timetables. In April 2021, the Department produced an initial product roadmap giving a broad outline of five products that it expects to launch first:

Roadside driver check
A ‘driver images’ product that allows the police to view a driver’s photograph and, in future, other information from their Driver Vehicle & Licensing Agency (DVLA) record. A preliminary version has been rolled out to 15 police forces, with deployment to most local forces expected before the end of 2021. This provides data direct from DVLA systems and does not connect to the main technology developed by the Department.

Lost and stolen property
A national register of missing property. PNC property data are not widely used but the Department hopes to use this product to allow it to demonstrate that it can deliver technology to the police.

Front-line person check
An application to help front-line police officers decide whether a person they have encountered is vulnerable, wanted or a threat. This product could provide images and improved search algorithms not found in the PNC.

Managing vehicles of interest
An application that would enable police officers to create and maintain descriptions of vehicles so that appropriate action can be taken.

Audit
Tools to identify and act against misuse of NLEDS systems and data.

3.19 The programme team is changing the way it delivers technology to be more iterative. The November 2020 external programme review recommended an ‘agile’ approach in which technology is released gradually and changed in response to feedback. The Department’s view is that such an approach should help the programme develop technology to meet the police’s needs. Our work on government digital programmes has shown that agile approaches are effective when adopted appropriately, including, for example, targeting specific software deliverables using the right expertise.12 The programme does not yet have a way to quickly deploy technology for users to test, although it is working on an approach to achieve this. The Department does not know how frequently the police will be able to trial early releases and provide feedback to help the programme make changes. The programme’s product strategy, which is still being drafted, notes that products are still constrained by the need to meet the needs of users who are used to the PNC.

Appointing new suppliers to deliver technology

3.20 The programme plans to establish a set of suppliers from which it will award contracts to develop the NLEDS products. The Department appointed its first new supplier in May 2021. It intends that suppliers will develop the specification of each product, propose a price and timetable for completing it, and then deliver the product.

3.21 The business case states that the programme will seek to amend contracts to allow successful suppliers to deliver additional products under the same contract. To avoid potential legal challenges, the Department will need to ensure that any amendments comply with procurement law restricting material change to contract values.

3.22 The programme does not have a commercial strategy that sets out the rationale for this new model or how it will manage the pool of suppliers. The Department will need to assure itself that it understands suppliers’ proposals well enough to ensure that prices and timetables are reasonable. It will continue to be responsible for coordinating the work of multiple suppliers and ensuring that they produce interoperable products.

Users transitioning to NLEDS

3.23 Realising the productivity benefits of NLEDS will depend on the police using it as intended. The cost of the police adapting their data, training, processes and information and communication technology (ICT) systems to use NLEDS is not included in the March 2021 estimate of the cost of NLEDS. In July, the Department revised its estimate to include funding for user organisations of between £30 million and £43 million, but this has not yet been validated with the police. The police ICT landscape is complex and transition to NLEDS cannot be achieved just through deploying new technology. It will require the police to adapt their systems and business practices.

3.24 The programme plans to give the police more control over how they transition to NLEDS but it needs new technology to make this possible. Before the reset, the programme planned that the PNC would hold the master copy of data until it was turned off, which meant that all users who needed to enter or update data in the PNC would need to transition to NLEDS at the same time. Now police forces will adopt NLEDS at different times, so data need to pass between NLEDS and the PNC. Such two-way data replication has not yet been proven to work. It needs careful testing to ensure that data entered into NLEDS, which may take advantage of new features not in the PNC, are not degraded once passed back into the older PNC system.

3.25 To make the transition work, the programme needs to integrate NLEDS with the existing police digital landscape. Many police users access the PNC indirectly via third-party systems from some 25 suppliers. Although these offer a more modern interface than the PNC, some police officers told us that systems made by different vendors do not interoperate, so data cannot be shared on a national level. These systems either need to be replaced or upgraded to work with NLEDS, but it will be difficult for the programme to ensure that this happens because the contracts are operated by individual police forces. The programme does not have a plan for managing the risk that these systems are not upgraded.

3.26 Once the transition is complete, the Department will need to ensure that NLEDS is managed as a live service for its users. We have noted that this issue also arises in the Department’s Emergency Services Network programme.13 The independent review of the January 2021 PNC data loss incident concluded that the PNC is run by a team that does not have a detailed understanding of how the police operate. This increases the risk of changes being implemented incorrectly. The review questions whether the Department is best placed to run any operational police ICT system. The Department told us that, since the data loss incident, it had involved the police more closely in the PNC’s governance.

10 The IPA defines amber as “Successful delivery of the programme/project to time, cost and quality appears feasible but significant issues already exist requiring management attention. These appear resolvable at this stage and, if addressed promptly, should not present a cost/schedule overrun.”

11 Comptroller and Auditor General, Challenges in implementing digital change, Session 2021-22, HC 575, National Audit Office, July 2021.

12 Comptroller and Auditor General, Challenges in implementing digital change, Session 2021-22, HC 575, National Audit Office, July 2021.

13 Comptroller and Auditor General, Progress delivering the Emergency Services Network, Session 2017–19, HC 2140, National Audit Office, May 2019.

Appendix One

Our audit approach

1 This report assesses the Home Office’s (the Department’s) National Law Enforcement Data Service (NLEDS, or the programme). We assess the:

Department’s progress in delivering the NLEDS programme by 2020 (Part One);

need for the 2020 reset of the programme (Part Two); and

way forward for the NLEDS programme (Part Three).

2 Our audit approach is summarised in Figure 10. Our evidence base is summarised in Appendix Two.

Appendix Two

Our evidence base

1 Our independent conclusions on the Home Office’s (the Department’s) programme to deliver the National Law Enforcement Data Service (NLEDS, or the programme) were reached following our analysis of evidence collected between December 2020 and July 2021.

2 We applied an analytical framework with evaluative criteria, which considered what arrangements would be optimal for delivering the programme. Our audit approach is outlined in Appendix One. We assessed the Department’s progress in delivering the NLEDS programme, the need for the 2020 reset of the programme and the way forward.

Progress delivering NLEDS for the police

3 To understand the need for the programme, we ran a series of interviews with Suffolk Constabulary, the Metropolitan Police and Merseyside Police to understand how they use digital systems such as the Police National Computer (PNC), the Police National Database (PND) and other third-party systems, what they need from NLEDS and whether the programme’s approach was meeting their needs. We spoke to a range of officers and staff within each force, including front-line response officers and staff who input data into the PNC. The forces we spoke to were selected to provide coverage of urban, suburban and rural areas but the views expressed are not taken to be representative of the whole of the police. We also interviewed non-police users of the PNC at the Disclosure and Barring Service, the National Crime Agency, the Driver & Vehicle Licensing Agency and the Ministry of Justice. Because of the ongoing COVID-19 pandemic, all interviews were held online.

4 We analysed the programme’s cost estimate from March 2021 and compared it with the original forecasts from 2016 to understand the increase in cost. Because the 2016 forecast was expressed as a range, we took the mid-point as a baseline. To ensure comparability with the current forecast, we also adjusted the 2016 forecast to be in 2021-22 terms and to assume that NLEDS would run until 2035-36. The costs of the PND and the costs of the PNC before 2020-21 do not appear in the March 2021 estimate so we estimated those costs using estimates from the programme’s 2019 business case, adjusted to 2021-22 terms.

5 We viewed the user interface of the PNC, the PND and the prototype NLEDS front-end web application online to understand the current service, and how this might change under NLEDS. We also reviewed technical plans and documents that set out the components of NLEDS.

The reasons the programme needed a reset

6 We reviewed programme documentation to understand how the programme’s approach had developed and why the new approach had been taken. Documents reviewed included all business cases from 2016 to 2019 and the business case for the current reset, programme board minutes and management information from 2019 to 2021, and other project documentation.

7 We reviewed the independent reviews conducted by external parties on the programme, including the 2020 review led by the consultancy ThoughtWorks. We also interviewed Thoughtworks staff. In addition, we reviewed reports from the Infrastructure and Projects Authority from 2016 to 2021. To further understand the technical risks, we reviewed technical specifications, plans and risk registers. We drew on knowledge from the National Audit Office’s (NAO’s) Digital Hub to understand issues that arise for government delivering major digital programmes and replacing legacy systems.

8 To understand the commercial strategy, we reviewed programme documentation and key contracts. We also interviewed Department staff managing the contracts and setting the commercial strategy; and representatives from IBM, BAE Systems and Datalynx who worked on the programme; Fujitsu, that supplies the PNC mainframe; Software AG that supplies the PNC database and PNC application programming language; and CGI that provides the PND as a managed service. Because of the large number of contractors involved, we did not speak to all suppliers to the programme, but chose a selection based on contract value, duration of time involved and the nature of the work they were doing. In reviewing the contracts, we made use of the insights from the NAO’s Commercial and contract management: insights and emerging best practice document.

The remaining risks for delivering NLEDS

9 To understand the relationship with the police, we reviewed letters and other correspondence from the police since 2019, and we interviewed senior police leaders involved in the programme. We interviewed members of the programme team covering commercial strategy, technical development and user engagement as well as the programme director and current and former Senior Responsible Owners.

10 We reviewed key documents relating to the new strategy, including reports charting progress against the critical success factors. We reviewed the programme’s current plans and product strategy. Many of these documents were still being developed and our report sets out the position at the time of writing. We spoke to suppliers of systems that integrate with the PNC to understand how the reset affects the systems they provide to the police.

11 To understand the risk of not replacing the legacy systems, we analysed the most recently available data on PNC and PND performance from 2019 to March 2021. We reviewed the Department’s roadmap setting out the future of the PND and reviewed service level agreements and the contract for the network used by the PNC. We interviewed Information Commissioner’s Office personnel to understand their perspective on the regulatory risk. We reviewed documents relating to the data loss in January 2021 including the two reviews that the Department had commissioned.

Design and Production by NAO External Relations
DP Ref: 009266-001