Town Hall cyber attack puts planning decisions at risk of legal challenge

Hackney Council has been forced to make changes to how involves members of the community in planning decisions, after the serious criminal cyber attack on its systems left any such decision made by the borough open to legal challenge.

The attack, branded “morally repugnant” by Hackney Mayor Philip Glanville and leaving many of the hundreds of services provided by the council paralysed for extended periods of time, continues to have varied consequences weeks after it took place.

The most recently revealed is that the Town Hall remains unable to access data for planning applications stored on its IT systems, preventing it from notifying people or organisations who have made representations about such applications when decisions are made.

As a result and as a “last resort”, according to council documents, the borough’s planning chief Cllr Guy Nicholson has announced a temporary suspension of the council’s obligation to make such notifications through an amendment to its statement of community involvement (SCI).

Council officers have said that were the borough to do otherwise and issue planning decisions without complying with their own SCI, the Town Hall risks judicial reviews to its decisions “with all the attendant financial and reputational burdens that this brings”.

Introducing the decision, Nicholson said: “The SCI outlines the council’s standards for engaging and consulting with residents, businesses and other stakeholders in relation to our plan-making and decision-taking functions. It sets out when the council will consult and how the process will be carried out. During October 2020 Hackney Council was the subject of a serious criminal cyber attack which means that we need to make a temporary change to our SCI.

“Almost every council service has been affected by the attack, this includes the planning service. The principal impact of the cyberattack on the planning service continues to be the service’s ability to access electronic data. Critically this includes data submitted as part of the statutory planning application process.

“The planning service has responded swiftly by working closely with ICT to retrieve data but there are still a number of critical issues that still remain unresolved and there is still critical data that the service is not able to access.

“This affects the council’s ability to meet the commitment to notify all interested third parties of planning decisions as set out in the SCI. This means that any planning decision can be challenged and overturned as the full conditions set out in the SCI have not been met.

“To avoid this risk of challenge the proposed solution is to temporarily suspend this commitment to notify objectors of a planning determination pending the recovery of data rendered inaccessible by the cyber attack.

“The council’s planning service remains committed to being transparent in our decision making. Where it is technically possible it will continue to inform
interested third parties of planning decisions.”

In the report, officers say that data rendered inaccessible by the attack is likely to be “unavailable for some time to come”, with the service moving to a new system for receiving and considering new applications, which still leaves unresolved issues around proposals submitted through the old system.

The Town Hall has predicted that if its SCI remains unamended, then the passage of time makes it increasingly risky that it will face appeals against the decisions its planners make.

The changes to the SCI, which remove the obligation to notify of a decision people or organisations that make representations on an application in writing or by email, is understood to be temporary and subject to review “as soon as is practicably possible”.

Hackney Council was hit by the cyber attack at the beginning of October, blamed by Hackney Mayor Philip Glanville on organised criminals, with an investigation underway by the National Cyber Security Centre, National Crime Agency and local law enforcement.

The attack has also affected the council’s land charges processing system, which establishes whether the land on which property is situated has any restrictions which can be passed on to successive owners, which effectively put the borough’s property market on pause, according to local estate agents.

The Town Hall continues to be unable to confirm whether the incident is similar in nature to the ransomware attack that hit Redcar Council earlier this year, which is understood to have forced the local authority to rebuild its affected services from scratch at a cost of over £10m.

Speaking in October, Hackney Mayor Philip Glanville said: “All of us are incredibly angry that organised criminals have chosen to attack us in this way and in the middle of dealing with a global pandemic. It has put our work and the critical work of our frontline and backroom staff who are keeping our community safe at risk, and I think these actions are morally repugnant.”