Response from GROS to FOI request about Scottish census contract
19 October 2008 - SACC
Response from the General Register Office for Scotland (GROS) to a Freedom of Information request relating to the award of a Scottish census contract to CACI
Thank you for your request dated 7 September 2008 for information under the Freedom of Information (Scotland) Act 2002 in regard to the Scottish census contract with CACI. Answers to each of your questions are given below.
What is GROS's assessment of the risk to data security arising from the fact that CACI Ltd, as a wholly owned subsidiary of CACI International Inc, is under the full control of a company that is outside British and Scottish jurisdiction and isclosely linked to US defence and intelligence interests?
Response: The contract was awarded in accordance with EU procurement rules which do not allow bidders to be excluded simply because they are foreign companies, or have some involvement with the defence or intelligence industries. Neither do they allow unsubstantiated allegations to be used as a reason for not awarding a contract. CACI (UK) does not carry out any defence or military work. Its US parent company provides intelligence services to the US government - but the parent company will not be involved in the work on the Scottish census and will not have access to any personal census data. CACI (UK) are registered in the UK and therefore must comply with UK legislation.
The terms of the contract, and UK census and data protection legislation, mean that CACI (UK) and its sub-contractors are legally committed to protecting and maintaining the privacy of personal census details. Everybody who handles personal census details (including the staff of CACI (UK) and its sub-contractors) must sign a confidentiality statement which is backed up by a legal penalty - because it is a criminal offence under the Census Acts to disclose personal census information without authority.
GROS will own all Scottish census data. The data will be processed in Scotland and remain here at all times in both paper and electronic formats. Only British and Irish registered companies will have access to personal census data - no US company has any access to the data.
What will be the cost of any work undertaken by GROS staff working with CACI Ltd to ensure data security? What will be the cost of independent audits of security arrangements and procedures commissioned by GROS?
Response: Data security is paramount to GROS, and careful security arrangements are applied to every aspect of the census project. The security costs built into the contract would be the same regardless of the contractor. GROS have estimated and budgeted for independent security audits at approx. £60k for the census.
In awarding the contract, did GROS take into account any differences in the costs likely to be incurred under (2) for each of the bids?
Response: As stated above, security costs are generic, and there were no differences in the costs budgeted.
Did GROS take into account the unethical nature of the work done by CACI International Inc at Abu Ghraib Prison in 2003-2005 (the ethical issue arises from involvement in detention under policies that Amnesty International says deprive detainees of human rights guaranteed in international human rights norms; the issue exists whether or not CACI International Inc is found to be guilty of offences under US law)?
Response:At the time of contract award, GROS had been fully informed by the company about the work which CACI (UK)'s US parent undertook at Abu Ghraib on behalf of the US Government, the unsuccessful legal cases against them, and the company's rebuttal of the allegations. CACI (UK) has no defence interests, and no involvement in the cases. But the allegations have been vehemently denied by the parent company and the US Government has taken no action against the company. The law suits against the company, raised by Iraqi civilians 4 years ago and renewed recently, have not proceeded. In short, the allegations against the company have not been proved and it is of course a principle of our legal system that the accused is innocent until proved guilty. We would never knowingly be party to a contract with any company convicted of human rights abuses.
Does the contract with CACI Ltd provide for cancellation in the event that CACI International Inc or its staff are either convicted of a criminal offence in the US, or held liable under US civil law for human rights abuses?
Response: The contract with CACI (UK) provides for termination in several ways, mainly around the contractor's default or failure to provide the services in accordance with the agreed success criteria. There is no specific provision for the event mentioned i.e. that CACI International Inc or its staff are either convicted of a criminal offence in the US, or held liable under US civil law for human rights abuses.
But there is provision for termination "for convenience" by GROS by providing the necessary notice period and paying compensation.
What is GROS's assessment of the risk to data quality arising from a possible lack of public confidence in CACI?
Response: GROS assesses the risk as low, for the following reasons:
- there was no adverse effect on data quality in the 2006 census in the Republic of Ireland where CACI (UK) provided similar services in support of the census as it is contracted to provide for the Scottish census in 2011.
- the more distant experience of the Republic of Ireland 2002 census, where again CACI (UK) provided similar services, and the experience of the UK census in 2001, where similar services were provided by Lockheed Martin (UK), also indicated no adverse effect on data quality through a lack of public confidence with any of the contractors used.
- the much more distant experience of the UK census in 1991 ( when there was the threat of a large-scale non-compliance campaign as a protest against the introduction of the "poll tax" and some householders initially refused to return the census questionnaire because they believed, incorrectly, that it would be used to inform the "poll tax" register) showed that clear publicity messages resulted in satisfactory data quality.
That point is reinforced by the fact that, since 1991, there have been great improvements in imputation techniques - that is, statistically-valid estimation of the characteristics of households and individuals who have failed to submit a census questionnaire.
Has GROS taken into account any costs that the Scottish Government may incur from measures taken (eg publicity) to mitigate this risk?
Response: The Scottish Government is unlikely to incur any such costs, because it is GROS which is responsible for taking the census. GROS already plans substantial publicity expenditure, linked to publicity by the other UK census departments, to encourage people to complete their census questionnaires. It is highly unlikely that that expenditure will have to be increased to cope with any possible lack of public confidence in CACI. Similarly, the cost of responding to questions from the public and the media about all aspects of the census is already factored into GROS's budget, on the basis of experience with previous censuses, and is very unlikely to be affected.
In assessing value for money, did GROS take into account the effect on future policy-making of any loss of data quality arising from a possible lack of public confidence in CACI?
Response: See response to question 6.
How many companies put in bids for the contract?
Response: The contract was advertised in the Official Journal of the European Union in December 2007 as 5 Lots. A total of 89 companies lodged Expressions of Interest for the various Lots, 27 of whom completed the PQQ (Pre-Qualification Questionnaire). 8 companies were then taken through to the final stage and were issued an ITT (Invitation to Tender), and from those 5 bids in total were received.
Reproduced under the terms of the Click-Use Licence.
http://www.opsi.gov.uk/click-use/index.htm
