Bank of England audio leak followed loss of key cybersecurity staff
Exclusive: former employees say at least 20 security staff were reassigned or left in past year
The Bank of England restructured its security department and lost multiple senior employees in charge of protecting some of Britain’s most critical financial infrastructure shortly before it suffered a major breach, the Observer can reveal.
After the central bank admitted that hedge funds had gained early access to its market-moving press conferences via a backup audio feed, multiple former employees contacted the Observer to warn that the Bank was struggling with the departure of key staff responsible for protecting it against external threats.
The sources said at least 20 of the Bank’s staff tasked with information security had left or been reassigned elsewhere within the bank within the past year, raising questions over the protection of the nation’s payment systems and other critical infrastructure vital for the British financial system. The Observer was able to verify 13 of these departures using information from social media and other sources.
The revelations come at a sensitive time for the Bank as it prepares for the handover of power in March from Mark Carney, the outgoing governor, to Andrew Bailey, the current chief executive of the Financial Conduct Authority.
Threadneedle Street has also played a central role in efforts to improve the safety and integrity of the financial system since the 2008 banking collapse, including warning the industry to improve its cyber and information security operations. It is responsible for key parts of the nation’s critical infrastructure, including the payments systems that carry every bank transfer made in Britain, the wages of millions of people, cheques, and payments between businesses of all sizes. On an average day in 2018, the Bank’s real-time gross settlement system (RTGS) settled transactions worth £651bn.
According to the former employees, the Bank’s chief information security officer and two deputies have left in the past year.
Multiple former employees described the organisation as beset by budget cuts before Carney’s departure, against a backdrop of concerns over cost efficiency. They said there were problems with staffing given the departures and low staff morale.
Much of the disquiet stemmed from a move to dismantle the Bank’s “security and privacy” directorate, the people said. The team, part of the central services division, previously had oversight over cyber, personnel and physical security matters, as well as privacy. Staff and responsibilities were instead spread across other parts of the organisation.
It is understood that many of the people now sit under the Bank’s technology, security and risk directorates, in a move designed to make the organisation safer. The Bank has about 70 cybersecurity professionals.
A Bank of England spokeswoman said: “The Bank operates the highest standard of information security and is confident in our ability to recognise cyber threats and defend our systems appropriately. Earlier this year, the Bank completed a review of its central services target operating model and, as part of that, reinforced the arrangements for first- and second-line information security. This change was fully supported by the Bank’s audit and risk committee.”
The Bank admitted late on Wednesday night that it had suffered a security breach, with a provider of a backup audio feed of the governor’s market-sensitive press conferences selling early access to unnamed investors without its knowledge. Those investors could have used the few seconds’ advantage to profit.
It was alerted to the breach by the Times newspaper, conducted a rapid internal investigation and passed the matter to the FCA. The City watchdog has confirmed it is investigating the issue, and it is understood that Bailey will recuse himself from all discussions of the matter to avoid any suggestion of a conflict of interest.
The Bank’s chief operating officer, Joanna Place, is the most senior manager responsible for physical and information security, and faced calls to resign from a former member of the Bank’s monetary policy committee, Danny Blanchflower, following the breach. Place, who was appointed in July 2017, reports directly to the governor, and has an equal status to the Bank’s deputy governors.
Multiple sources said the Bank was under pressure to cut the budget of the central services division, which was managed by Place. They said the government spending watchdog, the National Audit Office, warned in December 2018 that the Bank needed to deliver better value for money.
Place told the Commons’ public accounts committee in January that the Bank did not “have any gaps in cybersecurity”. However, her chief information security officer, Cameron “Buck” Rogers, resigned little over a month later. Multiple other security experts followed him.
A spokeswoman for the Bank said Rogers resigned on 23 February and that Place was not aware he was going to quit when she gave evidence on 21 January.
At the hearing, Meg Hillier, the Labour chair of the committee, expressed surprise at Place’s answer, given the difficulties other public-sector organisations had with recruiting and retaining cyber security staff, and asked again if there were any vacancies.
Place responded: “Offhand, I do not know whether we have any vacancies, but we do not have a problem with recruiting and we do not have a problem with retention in cyber, either.”
There was widespread unease within the Bank following her testimony, multiple sources said, and in the months after her appearance the cybersecurity function suffered the outflow of staff.
The public sector struggles to retain staff in cybersecurity roles because of intense competition from the higher-paying private sector. However, the reputation of the Bank and its important role in protecting financial stability are attractive for potential candidates, and the sources said they believed it was in the public interest to shed light on the problems it was facing.
A Bank of England spokesperson said: “The incident relating to the misuse of a backup audio feed from the Bank’s press conferences by a third-party supplier, which the Bank has referred to the Financial Conduct Authority for further investigation, was not a cyber security issue.”
After the central bank admitted that hedge funds had gained early access to its market-moving press conferences via a backup audio feed, multiple former employees contacted the Observer to warn that the Bank was struggling with the departure of key staff responsible for protecting it against external threats.
The sources said at least 20 of the Bank’s staff tasked with information security had left or been reassigned elsewhere within the bank within the past year, raising questions over the protection of the nation’s payment systems and other critical infrastructure vital for the British financial system. The Observer was able to verify 13 of these departures using information from social media and other sources.
The revelations come at a sensitive time for the Bank as it prepares for the handover of power in March from Mark Carney, the outgoing governor, to Andrew Bailey, the current chief executive of the Financial Conduct Authority.
Threadneedle Street has also played a central role in efforts to improve the safety and integrity of the financial system since the 2008 banking collapse, including warning the industry to improve its cyber and information security operations. It is responsible for key parts of the nation’s critical infrastructure, including the payments systems that carry every bank transfer made in Britain, the wages of millions of people, cheques, and payments between businesses of all sizes. On an average day in 2018, the Bank’s real-time gross settlement system (RTGS) settled transactions worth £651bn.
According to the former employees, the Bank’s chief information security officer and two deputies have left in the past year.
Multiple former employees described the organisation as beset by budget cuts before Carney’s departure, against a backdrop of concerns over cost efficiency. They said there were problems with staffing given the departures and low staff morale.
Much of the disquiet stemmed from a move to dismantle the Bank’s “security and privacy” directorate, the people said. The team, part of the central services division, previously had oversight over cyber, personnel and physical security matters, as well as privacy. Staff and responsibilities were instead spread across other parts of the organisation.
It is understood that many of the people now sit under the Bank’s technology, security and risk directorates, in a move designed to make the organisation safer. The Bank has about 70 cybersecurity professionals.
A Bank of England spokeswoman said: “The Bank operates the highest standard of information security and is confident in our ability to recognise cyber threats and defend our systems appropriately. Earlier this year, the Bank completed a review of its central services target operating model and, as part of that, reinforced the arrangements for first- and second-line information security. This change was fully supported by the Bank’s audit and risk committee.”
The Bank admitted late on Wednesday night that it had suffered a security breach, with a provider of a backup audio feed of the governor’s market-sensitive press conferences selling early access to unnamed investors without its knowledge. Those investors could have used the few seconds’ advantage to profit.
It was alerted to the breach by the Times newspaper, conducted a rapid internal investigation and passed the matter to the FCA. The City watchdog has confirmed it is investigating the issue, and it is understood that Bailey will recuse himself from all discussions of the matter to avoid any suggestion of a conflict of interest.
The Bank’s chief operating officer, Joanna Place, is the most senior manager responsible for physical and information security, and faced calls to resign from a former member of the Bank’s monetary policy committee, Danny Blanchflower, following the breach. Place, who was appointed in July 2017, reports directly to the governor, and has an equal status to the Bank’s deputy governors.
Multiple sources said the Bank was under pressure to cut the budget of the central services division, which was managed by Place. They said the government spending watchdog, the National Audit Office, warned in December 2018 that the Bank needed to deliver better value for money.
Place told the Commons’ public accounts committee in January that the Bank did not “have any gaps in cybersecurity”. However, her chief information security officer, Cameron “Buck” Rogers, resigned little over a month later. Multiple other security experts followed him.
A spokeswoman for the Bank said Rogers resigned on 23 February and that Place was not aware he was going to quit when she gave evidence on 21 January.
At the hearing, Meg Hillier, the Labour chair of the committee, expressed surprise at Place’s answer, given the difficulties other public-sector organisations had with recruiting and retaining cyber security staff, and asked again if there were any vacancies.
Place responded: “Offhand, I do not know whether we have any vacancies, but we do not have a problem with recruiting and we do not have a problem with retention in cyber, either.”
There was widespread unease within the Bank following her testimony, multiple sources said, and in the months after her appearance the cybersecurity function suffered the outflow of staff.
The public sector struggles to retain staff in cybersecurity roles because of intense competition from the higher-paying private sector. However, the reputation of the Bank and its important role in protecting financial stability are attractive for potential candidates, and the sources said they believed it was in the public interest to shed light on the problems it was facing.
A Bank of England spokesperson said: “The incident relating to the misuse of a backup audio feed from the Bank’s press conferences by a third-party supplier, which the Bank has referred to the Financial Conduct Authority for further investigation, was not a cyber security issue.”