The following Statement was made in the House of Commons on Wednesday 8 May.
“With permission, Mr Speaker, I will make a Statement about disruption at the border.
At around a quarter to eight last night, the Home Office became aware of a significant IT outage. Investigations determined that the incident was caused by technical issues within the Home Office network. The relevant teams quickly swung into action and a technical response was under way within six minutes. Once the fault was identified, officials worked closely with partners to rectify the problem and restore service. I joined a gold call with the lead officials at midnight last night, and the issue was resolved shortly before half-past midnight.
My information this morning is that all impacted systems have been restored and the incident has been formally closed, with all due diligence checks completed. At this stage, I can assure the House and the wider public that all security checks were maintained throughout. Border security was not compromised at any point, and there is no indication of malicious cyber activity. Police access to operational systems was unaffected.
As a result of the outage, there were delays at some airports, as Members will be aware. The queues remained manageable and within health and safety parameters. Staff on the ground supported passengers, including through the provision of water, and ensured that welfare needs were met. Although undoubtedly inconvenient, the delays were necessary to maintain the integrity of our border. That is not to minimise the impact of the disruption; I realise that it will have been frustrating for all those affected. I offer my thanks to passengers for their patience as urgent activity was mounted to resolve the incident. I also place on record my gratitude to all the personnel who were involved in the response, including staff within the Home Office and Border Force, and at airports.
I realise that a number of questions will arise from this occurrence. I will, of course, do my utmost to provide as much information as possible, with the caveat that detailed work to understand the circumstances is ongoing. As the House and the public would expect, comprehensive activity to ascertain all relevant information about what happened will be undertaken in earnest in the coming days. Any incident involving our border systems causes concern—that is perfectly understandable. It is worth putting this into context, however. Border Force facilitated over 132 million passenger arrivals last year, consistently processing over 90% of passengers within service standards. As I have said, security was maintained at all times, an urgent response was mounted, and the issue was fully resolved in a matter of hours. None the less, I sincerely apologise for the disruption that occurred.
I can assure the House that the Home Secretary and I will be unswerving in our determination to ensure that every possible lesson is learned and that this does not happen again, and I know that will be the objective of everyone across the Home Office. The security, integrity and effectiveness of the UK border is paramount. It is my foremost priority, and will be for the entirety of the time that I have in this role. I commend the Statement to the House”.
My Lords, I thank the noble Lord for the repeat of this important Statement, which deals with the recent eGates outage affecting border control and security. I join the noble Lord and others in paying tribute to the staff who responded and the passengers who waited patiently for flights, often for many hours.
We all care passionately about our border security and are united in recognising its importance. There are, however, a number of serious points and questions for the Government that arise from what happened just a few days ago. This example is just the latest in a number of failures with the eGates system. Can the noble Lord reassure us that the Government’s confidence in this system has not been shaken and that the intention is still to expand the eGates network? Is the technical issue that was responsible in this case the same issue that caused previous outages?
The security of our borders is crucial, so can the noble Lord again confirm that the outage was the consequence of a technical failure and not of any malign actor? Can he also confirm that, although the system was down for a number of hours, no aspect of our border security was compromised in any way? Can he confirm that there was no cyber element to the attacks and that there are no weaknesses that could be exploited by adversaries?
In discussing this matter, the Minister in the other place said
“how we got to this point in the first place—as soon as the fix was put in place, the posture changed to getting us to a place where we better understand that root cause. That work is ongoing, and it would not be right for me to speculate on it”.—[Official Report, Commons, 8/5/24; col. 594.]
Is there still a problem, on which we have put a sticking plaster and called it a fix, while the root cause, as yet unidentified, remains? If so, what are we doing about it?
My Lords, I too pay tribute to the staff involved, both Border Force staff and other airport staff, who took the pressure when this occurred. It is now five days after this Statement was made in the other place and, understandably, the Minister there was able to give only limited detail and indicate that investigations were ongoing. Clearly there will be more known now than was known then, so can the noble Lord give us more detail and a commitment that, when the final report is produced, he will return to inform us about the lessons that it revealed? Getting this right is obviously vital.
The Government were lucky this time, as the issue occurred in the early evening, midweek, in early May—at a quiet time of the day, a quiet time of the week and a quiet time of the year. If it had occurred at peak time, the story would probably have been very different. This is the third eGate failure in a year. It simply cannot be acceptable to regard it as an inevitable part of a technology-based system, because even more complications are coming in the near future.
The UK Government are introducing the ETA—the electronic travel authorisation—for non-visa countries. This has already started with the Gulf countries, and plans to roll it out gradually—first to the rest of the world other than the EU, and then to the EU—are scheduled for October 2024. The EU is also introducing the EES—the entry and exit scheme—including facial recognition and fingerprints. This scheme’s full implementation has been delayed until after the Olympics and is now also expected in October. Surely it is a potentially fatal mistake to introduce both the ETA and the EES at the same time. Can I ask what discussions the Government are having with the EU to ensure that everything does not all coincide at the same time?
The general public are blissfully unaware of what lies ahead. What plans do the Government have to alert and inform people well in advance of the introduction of these changes? Can the noble Lord assure us that the technology for this is fully ready and thoroughly tested?
I thank the noble Lord and the noble Baroness for their questions, which I will endeavour to answer. I join them in thanking all the Border Force officers for their efforts.
On a question that the noble Lord, Lord Coaker, asked me, I take this opportunity to reassure the House that border security was not compromised in any way. I am also grateful to the public, who were extremely patient, and I join my honourable friend in the other place in offering our sincere apologies for the inconvenience caused to them.
It is worth giving a little context about eGates, because they have revolutionised the experience at the border, as I am sure all noble Lords can attest. Many more checks are performed automatically than was previously possible, and it is now quicker, as the noble Baroness, Lady Randerson, has just noted, for many passengers to land in the UK.
The eGates generally continue to perform extremely well, and most ports report that an average of 90% of passengers eligible to use eGates use them very successfully. The Border Force facilitated over 132 million passenger arrivals last year, with 90% of those within current service standards. The number was even better in the fourth quarter of last year; it was 96.7%. I am grateful for its efficiency and, much as it will regret the occasional blip, none the less it is generally speaking a very strong story.
The noble Lord, Lord Coaker, asked whether the root cause has been identified and rectified. Engineers identified the cause of the outage—and it was an outage—as a capacity issue. That was on an element of the network that controls network traffic within the data centres. The incident was caused by the cumulative effect of changes we have been making to sustain and modernise the network environment; incidentally, those will produce increased resilience over the summer. All the incidents that have affected the eGates have been singular and nothing has been repeated. The technical term for the outage was something to do with a logical network route—at which point, I confess I rather glazed over and did not really understand the further technical remarks that were made to me. But I am reassured that that has been entirely dealt with; capacity has been increased, and this therefore should not happen again—I hesitate to say it will not happen, but it should not.
My Lords, the eGates software is provided by a fairly small Portuguese company called Vision-Box, under a contract that was signed in 2013 and has been extended to at least 2027. As someone who spends most of his life working in software mergers and acquisitions, I can say that it would be pretty normal, when a key contract such as this is entered into with a smaller supplier, that a change of control clause would be included in the contract, allowing the customer—the Government in this case—to obtain safeguards about future performance before any takeover of the company is completed.
Vision-Box was taken over in April by a very large Spanish group called Amadeus. Was there a change of control clause in the contract? Were suitable undertakings obtained from Amadeus before Vision-Box was acquired? Can the Minister confirm that the outage was not related to changes made by Amadeus as a result of the takeover? Looking forward, I understand that the Vision-Box software is currently based on Windows 10, which will no longer be supported beyond 2025—so is the Minister confident that Amadeus is committed to a suitable upgrade path?
I will address the last points first. As I said, it was not a software issue that caused this particular outage, so I can deal with that relatively straightforwardly. As regards government contracts, as the noble Lord will be aware, I think they are all published on GOV.UK. I am not sure if this one was or if I am wrong there, but I will check and find out and come back as required.
I did not know about the Amadeus takeover of this particular Portuguese company, but I will make further inquiries and, if there is more to be said, I will write to the noble Lord.
My Lords, will the Minister agree that one of the lessons from earlier outages was the need to be able bring in extra staff and surge staff if it ever happened again? Of course, it did happen again and the fact that the staff were able to get into place very quickly is to be commended and the staff involved need to be thanked and congratulated on their swift response.
The Minister in the other place said that he could not comment further on the root causes of the outage: however, the Minister here went into more detail on that. Is that the update the Minister in the other place promised last Wednesday and is there nothing more that can be mentioned about that and elaborated on? Also, when the EES comes in—which the noble Baroness dealt with at some length—can the Minister tell the House whether it will apply to flights from the UK to airports in the Republic of Ireland?
As I have already said, I do not know to what my right honourable friend in the other House was referring when he talked about updates, so I am afraid I do not know whether I have just given an update on his points. What I can say—and should have said in my opening remarks—is that the lessons learned exercise is still ongoing, so I cannot say that that is fully concluded yet because it is not. I am afraid I do not know the answer regarding the Republic of Ireland. From memory, I do not think the Republic of Ireland is a member of the Schengen agreement, so I am not actually sure how that affects it.
20 of 36 shown
Can the noble Lord also reassure us that any lessons learned are being implemented as a matter of urgency and that all the contingency plans that were in place are being reviewed in light of how well they did or did not work?
As an aside to this issue, can the noble Lord also take the opportunity to give a guarantee that all necessary preparations are in place in Dover for when new entry and exit checks are introduced in the autumn?
Alongside the introduction of eGates, automation and new technology, do the recent issues that have arisen not highlight once again the need for a visible, physical Border Force presence at our ports? Yes, we need people to help and advise—that is crucial and important—but also those whose job it is to ensure compliance with and the enforcement of our laws at the border.
There cannot be another repeat of the chaos we saw recently at our borders. These problems seem too persistent and to occur regularly. That undermines the confidence of all of us in the security of our borders. It undermines that public faith which is so crucial to the integrity of our country, as we all must believe that our border security system works and works well—because that is in all our interests, is not it?
Both UK and EEA citizens can use eGates, and the Government have recently added 10 more countries to the list of those that can use them. That is why eGates are so busy. Ironically, instead of taking back control of our borders following Brexit, we have in fact reduced the number of controls at our borders. Noble Lords will know that when we UK citizens go abroad to the EU now, we are not able to use eGates in most cases; we are required to queue up, and very often we have to answer detailed questions about our visit, rather like we do if, for example, we visit the USA. We no longer have the privilege of easy entry and exit from EU countries. We are making life easier for people coming here, but life is not being made easier for us going to other places.
We all know that having a physical presence is a major deterrent to people wanting to abuse access to this country. Does all this not underline the need to keep a strong physical presence of Border Force officers at our points of entry and exit from this country?
I turn to the other questions asked of me. There was no malign actor, hacking or cyberactivity associated with this; it was simply a capacity issue with regard to the network infrastructure. That also rules out software and hardware problems; it really was just about system capacity. As I have already said, there were not any vulnerabilities at the border.
I was asked questions about the EU Entry/Exit System. As I have said before from the Dispatch Box, the Government are doing as much as they possibly can to prepare for the implementation of the EES and its impact on British travellers, particularly at the juxtaposed border controls in Dover, at Eurostar in St Pancras and at the Channel Tunnel. We engage regularly with the Commission and the French Government at every level. Beyond this, we hosted the director-general of the Police aux Frontières on his visit to Dover, St Pancras and Folkestone last month. We continue to work with the port operators to understand the impacts of the EES and obviously support their plans to mitigate them.
We are working up plans to make sure that the public are kept abreast of all these new requirements, and that any impacts they may have on their future travel plans are well understood in advance. I believe my right honourable friend in the other place is due to appear before the European Select Committee on this, at which point no doubt much more will become available. The European Commission guidelines have not yet been issued, so there is not much more I can say about the European side.
As regards the timing and phasing of this, obviously the ETAs have now been in operation for a while—certainly going back to last year. They are not, as it were, coincident. The simple fact of the matter is that it may be inconvenient for us if the EU is tightening its border controls, but I respect and defend its right to maintain its own border integrity, as we do.
I was asked about a physical presence at the border. I agree: of course, there must be a physical presence. However, there has been much chatter about things such as roving officers, and so on. I reassure noble Lords that the border is not compromised by a roving officer not being present; they do not control who can pass through the eGates. The eGates undertake all the security measures of passengers who use them.
It is simply not true that this involves reduced control. Individuals who use these eGates—this answers one of the questions asked by the noble Baroness, Lady Randerson—are not routinely questioned by Border Force officers, but they continue to conduct a full range of security checks, and the biometric check they undertake to compare the person with their travel document means that they are a highly effective means of detecting imposters. They are also able to identify pre-existing adverse information about travellers, and individuals subject to information will be seen by a Border Force officer. If officers require information about any person’s previous immigration history, the Home Office has access to data, including advance passenger information and exit record checks, to be able to verify a person’s individual history. Those officers retain the ability to exercise the full range of their powers at the border, and will continue to refuse entry, where appropriate, to those they deem eligible. I agree that it needs to be visible, but it is effective.
To go back to what the ETA actually is, it is a digital permission to travel to the UK for those who want to visit who do not need a visa. As the noble Baroness correctly pointed out, the scheme has already launched for nationals of the Gulf Cooperation Council countries—Bahrain, Kuwait, Oman, Qatar, the UAE, the Kingdom of Saudi Arabia and Jordan. Other non-visa nationals will be able to apply for ETAs later this year. We believe they are making the UK safer, because they enhance the Government’s ability to screen travellers and prevent those who pose a threat getting on a plane, ferry or international train. Of course, by knowing more in advance of travel, our ambition is to increase automation of passenger clearance at the border and generally improve the experience.
I think I have answered all the questions, but I reassure noble Lords that this was a one-off incident and I am reliably informed that it has now been corrected and that additional capacity has been put in place. Obviously, I would not like to claim that it will never happen again but, as far as I am aware, the situation has been dealt with and again I thank Border Force officers and those in the Home Office data and digital team who worked very hard on this.