UKvisas
184. UKvisas has a contract with the Visa Facilitation
Service (VFS) to provide a visa application service in India,
Nigeria and Russia. On 16 May 2007, the FCO closed VFS's online
service worldwide and confirmed that there had been a security
breach of the personal details of visa applicants in India.[313]
185. VFS and UKvisas had first been informed of the
security problem in India in December 2005 and applicants in Nigeria
had reported a similar problem in April 2006. On both occasions,
VFS had taken some remedial action.[314]
The FCO told us that the view of its legal advisers was that liability
for any compensation rested with VFS, not UKvisas.[315]
186. Following the security breach, the then FCO
minister, Lord Triesman, announced an independent investigation
by Mrs Costelloe Baker, Independent Monitor, UKvisas, into the
security breach. Costelloe Baker's report was laid before Parliament
on 26 July. It found that "no third party penetration tests
were carried out in the development phase of the online system
or after it was launched", a failing which it described as
"serious and very basic".[316]
The report also highlighted other basic security failings within
VFS[317] and recommended
that the online facility should not be reopened.[318]
On UKvisas' responsibility, the report found that UKvisas did
not follow best procurement practices in acquiring some of the
visa support services,[319]
nor react adequately to notifications of the weakness.[320]
The report recommend that UKvisas' Board should include a member
with responsibility for governance of information assurance.[321]
187. The FCO's response to the report agreed that
VFS' online facility should not be reopened. Instead it will be
replaced by visa4uk, UKvisas' online application service. The
FCO's response also stated that the UKvisas Corporate Services
Director would take on the role of Chief Information Officer and
that a Technical Design Authority would be established to "ensure
the overall coherence and integrity of UKvisas' business processes".
UKvisas would also be revising its complaints procedures. It was
already undertaking a strategic review of data processing (including
by Commercial Partners), in order to strengthen Data Protection
Act risk management processes, and would carry out a detailed
audit of Commercial Partners' data security procedures and practice
in light of the Report.[322]
188. In our South Asia Report we concluded
that the outsourcing of visa applications handling had greatly
improved the process for visa applicants.[323]
We are therefore very concerned to hear that VFS' online facility
was not secure. Given the
basic weaknesses in VFS' online facility, we agree that it should
not be reopened. We are particularly concerned that, according
to the findings of Costelloe Baker's independent investigation,
UKvisas did not follow best procurement practices nor adequately
respond to prior warnings of the security weakness. We welcome
the action set out in the FCO's response to the investigation.
In particular we conclude that it is vital that UKvisas carry
out an audit of all its commercial partners' data security procedures.
We recommend that UKvisas share the results of this audit with
us.
189. In September 2007, the FCO informed us that
"detailed discussions" were now underway on the integration
of UKvisas with the Home Office's Border and Immigration Agency.[324]
We learnt more about this merger when we visited UKvisas in October
2007. We urge the FCO to keep us informed of UKvisas' progress
in making this transition.
Telephone services
190. During the course of our inquiry, we received
a memorandum from a British national working in the US complaining
about the cost of calling the British Embassy in Washington. The
memorandum drew attention to the fact that the calls were handled
by an external company, Abtran Ltd.[325]
191. We asked the FCO about the extent of outsourcing
of its lines across its network and the average cost of calls
to such lines.[326]
It told us that most calls at FCO posts were handled by FCO staff
at "normal" rates. However, UK visas had signed contracts
with CSC Computer Sciences Corporation and VFS Global Ltd for
visa applicant lines, with an average cost per call across all
countries where the service was already in place of US$6. A "number
of posts" had also outsourced phone handling in order "to
deal with the large volume passport enquiries". Some of these
were local contracts, but the FCO also had one central framework
contract for seven posts in Europe and North America with Abtran.
The FCO told us the call charges for these calls varied by country,
but that "a call made from Spain would cost an average of
£3.00, from Germany £3.32, from the US, £5.00,
and Canada £8.00".[327]It
added that the FCO received no income from the telephone inquiry
lines handled by Abtran Ltd in the last 12 months and that the
surplus the company made allowed it to run lines at no cost to
the FCO.[328]
192. We are
concerned by the cost of calls to Posts on outsourced lines managed
by Abtran Ltd. While we understand why Posts with high levels
of inquiries might wish to outsource phone-handling, we find it
unacceptable that British nationals are having to pay as much
as an average of £8.00 to call the British Embassy in Canada.
We recommend that in its response to this Report, the FCO share
with us the process of procurement leading up to the central framework
contract with Abtran. In particular we would like to know whether
it considered the likely average call charges and whether these
charges are limited in the contract.
246 Ev 13 Back
247
Ev 53 and 63 Back
248
Ev 114 Back
249
Ev 49 Back
250
Ev 103 Back
251
Foreign and Commonwealth Office, Eight Report from the Foreign
Affairs Committee Session 2005-06: Response of the Secretary of
State for Foreign and Commonwealth Affairs, Cm 6791, January
2007, response to recommendation 16 Back
252
Foreign and Commonwealth Office, Eight Report from the Foreign
Affairs Committee Session 2005-06: Response of the Secretary of
State for Foreign and Commonwealth Affairs, Cm 6791, January
2007, response to recommendation 16 Back
253
Unclassified minutes of FCO Board, 31 January 2007 and 22 May
2007 Back
254
Ev 104 Back
255
Foreign Affairs Committee, Eighth Report of Session 2005-06, Foreign
and Commonwealth Office Annual Report 2005-06, HC 1371, para
90 Back
256
Unclassified minutes of FCO Board, 3 April 2007 Back
257
Ev 114 Back
258
Ev 114 Back
259
Ev 14 Back
260
Ev 5 Back
261
Ev 111 Back
262
Ev 63 Back
263
Ev 54 Back
264
Unclassified minutes of FCO Board, 22 May 2007 Back
265
Ev 114 Back
266
Ev 114 Back
267
Ev 114 Back
268
Ev 114 Back
269
HC Deb, 5 June 2007, col 453W Back
270
Ev 105 Back
271
Unclassified minutes of the FCO Board, 23 July 2007 Back
272
Foreign Affairs Committee, Eighth Report of Session 2003-04, Foreign
and Commonwealth Office Annual Report 2003-04, HC 745, para
92 Back
273
HC Deb, 23 October 2007, col 192W Back
274
HC Deb, 23 October 2007, col 193W Back
275
National Audit Office, Foreign and Commonwealth Office Resource
Accounts 2003-04: Rationalisation of the Glencairn Estate in Dublin,
HC ("003-04) 1088 Back
276
Foreign Affairs Committee, Second Report of Session 2005-06, Foreign
and Commonwealth Office Annual Report 2004-05, HC 522, Ev
10 Back
277
HC Deb, 23 October 2007, col 192W Back
278
HC Deb, 23 October 2007, col 193W Back
279
Ev 91 [Sir Peter Ricketts] Back
280
Ev 92 [Sir Peter Ricketts] Back
281
HC Deb, 17 September 2007, col 125 WS Back
282
Ev 91-92 Back
283
Ev 91-92 Back
284
Ev 91 Back
285
Ev 109 Back
286
Ev 177 Back
287
Defence, Foreign Affairs, International Development and Trade
and Industry Committee, First Joint Report of Session 2006-07,
Strategic Export Controls: 2007 Review, HC 117, para 312 Back
288
Ev 29 Back
289
Foreign Affairs Committee, Eighth Report of Session 2005-06, Foreign
and Commonwealth Office Annual Report 2005-06, HC 1371, para
77 Back
290
Ev 14 Back
291
Ev 14 Back
292
Ev 14 Back
293
Ev 14 Back
294
Ev 14 Back
295
Ev 14 Back
296
Ev 14 Back
297
Ev 6 Back
298
Foreign and Commonwealth Office, Delivering Change Together:
The Consular Strategy 2007-2010 Back
299
Ev 29 Back
300
This article sets out an obligation of non-discrimination, i.e.
it requires EU Member States to treat requests for consular assistance
from unrepresented nationals of Member States on the same basis
as requests by their own nationals. Back
301
Ev 114 Back
302
European Union Document No. 6192/07 Back
303
European Scrutiny Committee, Sixteenth Report of Session 2006-07,
Documents considered by the Committee on 28 March 2007, including:
Conservation of the European Eel; Diplomatic and consular protection
of Union citizens in third countries, HC 41-xvi, para 2.6 Back
304
Ev 114 Back
305
Foreign and Commonwealth Office, Departmental Report 2006-07,
Cm 7099, May 2007, p 100 Back
306
Ev 109 Back
307
Foreign and Commonwealth Office, Delivering Change Together:
The Consular Strategy 2007-2010, p 14 Back
308
Foreign and Commonwealth Office, Delivering Change Together:
The Consular Strategy 2007-2010, p 14 Back
309
Ev 109 Back
310
Ev 109 Back
311
Ev 106 Back
312
Unclassified minutes of the FCO Board, 29 June 2007 Back
313
L M Costelloe Baker, Report of The Independent Investigation:
breach of data security in the VFS online UK visa application
facility, operated through VFS websites in India, Nigeria and
Russia, 16 July 2007, paras 2- 3 Back
314
Report of The Independent Investigation, paras 4-5 Back
315
Ev 69 Back
316
Report of The Independent Investigation, para 104 Back
317
L M Costelloe Baker, Report of The Independent Investigation,
paras 108 and 114 Back
318
L M Costelloe Baker, Report of The Independent Investigation,
para 158 Back
319
L M Costelloe Baker, Report of The Independent Investigation,
para 116 Back
320
L M Costelloe Baker, Report of The Independent Investigation,
para 179 Back
321
L M Costelloe Baker, Report of The Independent Investigation,
para 172 Back
322
Foreign and Commonwealth Office, Foreign & Commonwealth
Office response to recommendations contained in the Report of
the Independent Investigation: breach of data security in the
VFS online UKvisas application facility, operated through VFS
websites in India, Nigeria and Russia Back
323
Foreign Affairs Committee, Fourth Report of Session 2006-07, South
Asia, HC 55 Back
324
Ev 118 Back
325
Ev 180 Back
326
Ev 111 Back
327
Ev 114 Back
328
HC Deb, 24 May 2007, col 1476W Back