Emergency Business Continuity and Disaster Recovery Contract

This decision concerns the emergency award of contract to Orchid Cellmark Ltd in June 2019. The contract was for the provision of physical forensic services during a period of business continuity and disaster recovery (BCDR), following a ransomware cyber-attack on Eurofins Forensic Services (the managed service provider of physical forensic services to the Metropolitan Police Service (MPS)). Formal retrospective approval is requested to meet governance requirements.

The Deputy Mayor for Policing and Crime is recommended to approve the emergency award of contract to Orchid Cellmark Ltd for the BCDR provision of physical forensic services to the MPS, with retrospective effect from 13 June 2019 to 12 September 2020.

1. Introduction and background

1.1. On Sunday 02 June 2019, Eurofins Scientific, the European parent company of Eurofins Forensic Services (‘EFS’) suffered a ransomware cyber-attack. EFS is the managed service provider (MSP) of physical forensic services to the Metropolitan Police Service (MPS) (Agreement SS31502, the ‘MSP Contract’). As a precautionary security measure, EFS shut down their IT systems and operations until the threat to data security and their systems was resolved. The shut-down rendered EFS unable to conduct any laboratory based forensic examinations or even communicate with Policing, as they had no email/CJSM/internet services.

1.2. The EFS shut-down lasted for a period of 8 weeks, with phased resumption of services only permitted once EFS had satisfied the requirements of an independent assurance process set out by the NPCC (on behalf of Policing), the Forensic Science Regulator and the National Cyber Security Centre (NCSC).

1.3. During the period of EFS shut-down, the MPS had no direct contractual route to accessing the forensic analytical services usually delivered by EFS; these services included DNA casework, DNA crime scene stains, PACE DNA, Drugs, Toxicology, Marks and Traces, Questioned Documents and others.

1.4. As EFS provide 60% of the total forensic capacity in England & Wales, the EFS shut-down also caused a national crisis in forensic capacity. In response, three separate NPCC Gold groups, with numerous Silver sub-groups, and later an overarching NPCC Platinum group were stood up under the Operation name ‘Sourberry’. The MPS also had its own internal Gold and Silver groups to manage operational impact, working together with national Policing supported by the Forensic Capability Network (FCN).

2. Issues for consideration

2.1. The impact of not having access to the affected forensic analytical services for the duration of the EFS shut-down period would have included:

a. Increased risk to criminal justice outcomes, from being unable to provide forensic evidence in time, or at all, for trials or to meet custody and other statutory time limits;

b. Increase in criminal justice costs, from guilty pleas not being offered until very late in the criminal justice process because of the lack of forensic evidence;

c. Further significant increase to pre-existing forensic backlogs and extended turnaround times;

d. Loss of public confidence in policing and the criminal justice system.

2.2. The diversion of EFS work to Orchid Cellmark Ltd (Cellmark), as well as other Forensic Service Providers (FSPs), enabled the highest priority cases to be processed.

2.3. The diversion of work was directed and managed at a national level by Policing under the NPCC, supported by the FCN. Submission volumes were significantly capped and turnaround times were extended to manage demand.

2.4. In addition to the emergency award of contract to Cellmark, additional emergency BCDR contracts for physical forensic services were awarded to Key Forensic Services (KFS) and Analytical Services International (ASI), for the same reasons provided under this paper for Cellmark. However, the total values of those contracts fell within the delegated authority of the MPS and therefore only limited details are provided in this paper.

2.5. Further information is contained in the restricted section of the report.

3. Financial Comments

3.1. The total final value of the Cellmark BCDR Contract (the ‘CMK Contract’) is £1.774M. This cost has been entirely offset by a combination of i) the non-payment of the monthly fixed charges (managed service charge) and reduction in the volume service charges in June and July 2019, and ii) further submissions are only slightly higher than the EFS costs which would have been applicable if it had been processed under the MSP Contract.

3.2. Therefore, the funding for the CMK Contract can be met within the MSP Contract budget and no additional funding is required.

3.3. Further information is contained in the restricted section of the report.

4. Legal Comments

4.1. The Mayor’s Office for Policing and Crime (MOPAC) is a contracting authority as defined in the Public Contracts Regulations 2015 (the Regulations). All awards of public contracts for goods and/or services in excess of £189,330 shall be procured in accordance with the Regulations.

4.2. Paragraph 4.15 of the MOPAC Scheme of Delegation and Consent provides that the Deputy Mayor for Policing and Crime (DMPC) has delegated authority to award MOPAC contracts with a total value of £500,000 or above.

4.3. Regulation 32(2) of the Public Contract Regulations 2015 (PCR) sets out the following:

The negotiated procedure without prior publication may be used for public works contracts, public supply contracts and public service contracts in any of the following cases: ...

(c) insofar as is strictly necessary where, for reasons of extreme urgency brought about by events unforeseeable by the contracting authority, the time limits for the open or restricted procedures or competitive procedures with negotiation cannot be complied with.

… the circumstances invoked to justify extreme urgency must not in any event be attributable to the contracting authority.

4.4. The EFS shut-down presented genuine reasons of extreme urgency, because of the immediate risks to police investigations and CJS outcomes arising from the inability of the MPS to provide forensic evidence.

4.5. The EFS shut-down was not planned or contributed to by any MPS cause, and the sudden shut-down of the entire EFS operations (which represents 60% of the national forensic capacity) due to a cyber-attack, was beyond anything that the MPS could have reasonably foreseen.

4.6. It would have been impossible to comply with the usual timescales in the PCRs; as there was no time to run an accelerated procurement under the open or restricted procedures or competitive procedures with negotiation.

4.7. For these reasons, the contract can be lawfully awarded in compliance with Reg 32(2) PCR 2015.

5. Commercial Issues

5.1. The Cellmark BCDR Contract covered all new submissions made during the BCDR period, and any further submissions made after the BCDR period relating to cases which had been examined by Cellmark during the BCDR period, for the following services:

• DNA Casework (Cat 3)

• DNA Crime Scene Stains (Cat 2)

• DNA PACE (Cat 1)

• Marks & Traces, including fibres, footwear, glass, gunshot residue, hair, instrument marks, and all other contact trace evidence examination

• Questioned Documents

5.2. In respect of DNA Crime Scene Stains (Cat 2), Cellmark was already providing a limited quantity of these services to the MPS, via a Subcontract with EFS under the MSP Contract, prior to Op Sourberry. However, during the BCDR period Cellmark delivered direct to the MPS more than double the quantity of their usual volume under the EFS Subcontract.

5.3. Commercial Services were consulted when the emergency contract was initially put in place. Due to the complexity of the contract, the contracting route and the pressure on resources, plus the impact of Covid-19, the formal governance to approve the contract has taken some time to progress and the contact has now completed. This paper is now seeking retrospective approval.

6. GDPR and Data Privacy

6.1. The MPS is subject to the requirements and conditions placed on it as a 'State' body to comply with the European Convention of Human Rights and the Data Protection Act (DPA) 2018. Both legislative requirements place an obligation on the MPS to process personal data fairly and lawfully in order to safeguard the rights and freedoms of individuals.

6.2. Under Article 35 of the General Data Protection Regulation (GDPR) and Section 57 of the DPA 2018, Data Protection Impact Assessments (DPIA) become mandatory for organisations with technologies and processes that are likely to result in a high risk to the rights of the data subjects. However, due to the emergency giving rise to the recommended contract award it was not possible to complete a DPIA in advance of the recommended contract for services commencing or within the critical BCDR period.

6.3. The Information Assurance and Information Rights units within the MPS were fully consulted and engaged in the management of BCDR arrangements, and were represented on the MPS Op Sourberry Silver Group tasked with managing operational impact. The Information Assurance and Information Rights units were also consulted in the finalization of terms for the award of contract to Cellmark, to ensure compliance as far as reasonably possible with the DPA and GDPR in view of the retrospective nature of the contract.

7. Equality Comments

7.1. The recommendation relates to the diversion of existing contracted services to an alternative service provider for business continuity and disaster recovery purposes due to circumstances of extreme urgency. This action does not change any aspects of the service provision relating to equality or diversity. Cellmark is an Equal Opportunities Employer and as such is committed to ensuring that they are compliant to the Public Sector Equality Duty under the equality act 2010.

8. Background/supporting papers

8.1. Report.