A pc specialist has filed a grievance to the Investigatory Powers Tribunal (IPT) after being advised that they had failed the vetting course of simply earlier than beginning work as a expertise specialist at MI6’s London headquarters.
The IT specialist, who Pc Weekly is figuring out as RP to guard their id, claims the Secret Intelligence Service (SIS) didn’t comply with “procedural equity” and “due course of” when finishing up Developed Vetting (DV) for a full-time position at MI6’s London headquarters.
In a grievance to the Investigatory Powers Tribunal, RP claimed the vetting service was disorganised and delayed the vetting interview for 3 months – solely transferring ahead as a result of RP repeatedly intervened to politely ask for the method to be sped up.
MI6 in the end denied RP safety clearance six months after their preliminary software for the job. Nevertheless, the grievance alleges that vetting officers didn’t take the fundamental step of following up on interviews organized with individuals who had agreed to behave as referees for RP, together with a former police colleague.
RP, who’s a member of the LGBT+ group, has additionally complained to the tribunal about a number of makes an attempt to hack their e-mail and social media accounts, made inside days of exposing particulars of the accounts to the vetting service.
Vetting service below fireplace
UK Safety Vetting (UKSV), which supplies safety vetting companies for the intelligence companies and different authorities our bodies, has beforehand been criticised by the Nationwide Audit Workplace for its “poor” efficiency.
The Nationwide Audit Workplace (NAO) discovered that UKSV had processed solely 7% of Developed Vetting purposes throughout the required time-frame, and relied on outdated unreliable pc techniques, which lacked capability, had been too gradual and required intensive guide workaround, in line with a 2023 report.
A authorities spokesperson advised Pc Weekly it had addressed the problems raised by the NAO report and had made “vital enhancements” to vetting procedures, with 97% of vetting purposes being accomplished “according to agreed timelines”.
RP, an skilled software program engineer and crew chief, who has labored in non-public and public sector roles beforehand, handed Developed Vetting for a senior position in MI6 in 2009 and was shocked to not have handed vetting in 2024.
In a grievance to the IPT, RP argued that the SIS and UKSV didn’t comply with authorities steerage, which requires an assessor to keep in mind “all related info obtained through the vetting course of” earlier than making its choice.
“A salient level of this enchantment is that not one of the character referees that SIS’s vetter requested me to arrange conferences with reported being contacted to supply a reference. These included senior civil servants and former colleagues within the police service,” in line with the grievance.
RP mentioned within the grievance that they haven’t any means of realizing what, if any, info led to SIS’s choice to not grant safety clearance, nevertheless it was clear the vetters had not adopted authorities steerage.
“It appears clear at a minimal that failing to steadiness any such adversarial info (of which I can’t be conscious) by even bothering to talk with the referees they requested for is a transparent breach of the steerage,” RP wrote within the four-page grievance.
SIS gave ‘no causes’ for vetting refusal
The grievance additionally acknowledged that SIS’s Developed Vetting course of didn’t comply with authorities steerage that states “when safety clearance is refused, people should be knowledgeable and supplied with causes the place attainable”.
Nevertheless, in a letter to RP from “FCO Companies” in October 2024, a authorities recruitment agent advised RP: “I remorse that we’re unable for nationwide safety causes to supply suggestions on choices to not grant DV.” The letter additionally contained no info on how you can conduct an inside or exterior enchantment.
In keeping with the grievance, it seems the vetting officer could have used “nationwide safety” as an “excuse” for failing to finish the Developed Vetting course of, or could have made a biased or irrational choice with out investigating “the entire pertinent details”.
RP has additionally raised questions in regards to the refusal letter, which arrived on an “FCO Companies” letterhead when the Overseas and Commonwealth Workplace had been renamed The Overseas, Commonwealth and Growth Workplace (FCDO) following its merger with the Division for Worldwide Growth in 2020.
“The shortage of accuracy and care in proof by these errors was mirrored within the extra basic lack of accuracy and care taken by this division in finishing up its vetting perform lawfully and in accordance with the steerage. If they’ll’t even get their very own identify right, how can they be trusted to get vital particulars proper about candidates for DV clearance?” the grievance acknowledged.
Applicant hit by cyber assault
RP utilized for an IT place with SIS, primarily based at its London headquarters in Vauxhall Cross, in April 2024. By late June, RP had accomplished interviews and been supplied a job. It took an additional three months for SIS’s vetters to rearrange a Developed Vetting interview, however solely after RP needed to “recurrently lean” on the events to get the method transferring.
RP advised recruiters in an e-mail that that they had traced the IP tackle used to compromise their Fb Messenger account to a US tackle linked to the Russian Federation
Throughout an interview on 4 October 2024, RP talked about that they used an alias to speak with an aged relative on Fb Messenger throughout lockdown. Some weeks later, RP reported that the social media profiles they disclosed through the vetting interview had been topic to repeated makes an attempt by third events to realize entry.
RP was capable of hint a few of the IP addresses used within the assaults to the Russian Federation, some to Vietnam, whereas most of them got here from the US. The one profitable assault gained entry to the e-mail RP had arrange as an alias to speak with the aged relative.
The IT specialist acknowledged within the grievance that the social media accounts focused had been related to a number of identities and that there was no apparent indication they had been related to the contractor.
‘Barium meal’
“The one place that I famous these a number of identities as belonging to me was in my DV interview and related DV type,” the contractor wrote. “In intelligence circles, this type of scenario is what they’d name a ‘barium meal’. That’s, the supply of the assaults might be inferred from the truth that just one entity – FCDO’s vetting division – was conscious that the separate accounts focused belonged to the identical particular person.
“It’s of concern that a number of social media profiles in several names had been concurrently attacked when the one place these completely different profiles had been talked about collectively was throughout my DV interview.”
It’s of concern that a number of social media profiles in several names had been concurrently attacked when the one place these completely different profiles had been talked about collectively was throughout my Developed Vetting interview RP
The contractor has requested the IPT to research whether or not any try was made by the Overseas Commonwealth and Growth Workplace or any proxy performing on its behalf to entry their social media accounts.
The grievance additionally raised questions over the safety of non-public info gathered about them throughout DV, and whether or not there was ample safety in place to guard it from misuse by third events.
“The impact of my being denied DV clearance with out due course of is that I’m now left with a DV refusal on my document. I used to be advised throughout my vetting interview that if I didn’t go clearance, there was no proper of enchantment, and that FCDO wouldn’t change its choice,” RP wrote.
“I bought my house of 23 years in anticipation of taking on the position I had been supplied with SIS. There are due to this fact actual monetary losses related to FCDO’s actions ought to IPT discover them at fault.”
Precedent for overturning DV choices
Judges set a precedent for overturning the outcomes of Developed Vetting choices in 2021 when a judicial assessment discovered that Eric Sort, a specialist in felony justice and UK surveillance legislation, was wrongly denied Developed Vetting safety clearance.
Sort had been supplied a job as the primary head of investigations at surveillance watchdog IPCO, till an objection from MI5, which claimed he was “insufficiently deferential to the sanctity of confidentiality”, led to his safety clearance being withdrawn.
Judges discovered, nevertheless, that there was no nationwide safety cause why the vetting officer mustn’t have spelled out the considerations raised by MI5 to Sort so he might have supplied a targeted written response.
“The elephant within the room…is that on this case IPCO’s most well-liked candidate for a senior place was being refused DV safety clearance largely as a result of one of many three businesses which IPCO oversees had sturdy reservations about him,” they wrote in a 20-page ruling.
Delays and errors at GCHQ
RP beforehand skilled delays and errors in Developed Vetting after being supplied a job as a lead developer with GCHQ, the alerts intelligence company, in January 2021.
The IT specialist despatched a number of emails to GCHQ and the federal government’s nationwide safety vetting helpdesk after GCHQ incorrectly entered RP’s e-mail into the “eVetting” system.
That meant RP couldn’t full the vetting type and that particulars of RP’s vetting course of could have been despatched to an e-mail tackle belonging to another person.
When GCHQ emailed RP 4 months later to say that Developed Vetting had been delayed by three months, RP knowledgeable GCHQ that they had already taken one other position.
RP continued to obtain emails and cellphone calls from GCHQ asking how vetting was going, regardless of the IT specialist calling and emailing a number of occasions to substantiate they not wished the job.
Within the grievance to the Investigatory Powers Tribunal following their expertise at SIS, RP requested the tribunal, at a minimal, to put aside the choice to disclaim them DV clearance in order that it doesn’t stay on their document.
“If the IPT finds in my favour, I wish to be compensated for the lack of employment alternative that the FCDO’s failing to comply with due course of has triggered,” the grievance provides.
Authorities has made ‘vital enhancements’
A authorities spokesperson advised Pc Weekly: “We accepted the entire suggestions made by the NAO in 2023 and have made vital enhancements to our vetting procedures. In February 2025, over 97% of all vetting clearances had been accomplished according to agreed timelines.”
The federal government mentioned it doesn’t touch upon safety issues however maintained that “sturdy processes” are in place to defend towards potential cyber incidents.
It has a “long-standing coverage” to not touch upon issues referring to intelligence and people’ safety vetting. Authorities coverage is that “all employees endure mandatory vetting procedures in accordance with UKSV and Cupboard Workplace steerage.”
In keeping with authorities apply, “referees are a regular a part of the Developed Vetting course of, and are contacted as a part of an applicant’s clearance course of”.
RP’s safety vetting timeline
RP is obtainable a junior position at MI6 however declines
March 2009: RP is conditionally supplied a job on the Secret Intelligence Service (SIS), MI6, topic to completion of safety clearance.
July 2009: RP is given a beginning date for becoming a member of SIS after passing Developed Vetting, however decides to not take up the job.
January 2017:UK Safety Vetting (UKSV) is fashioned following a merger of the vetting companies run by the Overseas and Commonwealth Workplace and the Ministry of Defence.
March 2022: The Investigatory Powers Tribunal finds that the Dwelling Workplace unfairly refused a number one skilled in surveillance a senior position within the Investigatory Powers Commissioner’s Workplace, after an intervention from MI5 led to his safety clearance being unfairly refused. It finds the choice to not appoint Eric Sort because the organisation’s first head of investigations was “successfully prejudiced” by one of many our bodies IPCO was designed to supervise.
RP supplied a job at GCHQ however declines following vetting delays
December 2021: RP is obtainable a job as a lead software program engineer with the alerts intelligence company, GCHQ, topic to passing safety vetting.
8 January 2022: RP mails the nationwide safety vetting helpdesk asking the service to right their correspondence e-mail tackle, which had been mistyped in a letter giving details about preparations for Developed Vetting (DV) for the GCHQ position.
10 January 2022: The nationwide safety vetting helpdesk mails RP saying it’s unable to alter RP’s contact particulars in its software program and to contact GCHQ.
10 January 2022: GCHQ’s recruitment workplace confirms that it has corrected RP’s e-mail tackle in its data.
10 January 2022: RP emails the nationwide safety vetting helpdesk asking for copies of emails RP missed as a result of GCHQ had used an incorrect e-mail tackle.
10 January 2022: The helpdesk replies that it’s unable to take action as the inaccurate e-mail tackle remains to be on the system. The lacking emails contained hyperlinks to a safe “eVetting” account that RP wanted to entry to finish the vetting course of.
10 January 2022: After attempting unsuccessfully to make contact, RP once more emails the GCHQ recruitment workplace asking for the e-mail tackle of their eVetting account to be up to date to the proper e-mail tackle. It nonetheless has not been up to date, regardless of earlier assurances.
11 January 2022: GCHQ’s recruitment crew apologises and says it’ll right the e-mail on the eVetting type and can ship out a brand new letter by submit.
4 April 2022: GCHQ emails RP stating {that a} choice on their Developed Vetting has been delayed till July 2022.
5 April 2022: RP mails GCHQ declining the job, as 4 months after making a conditional supply, GCHQ has but to start out the vetting course of. RP states they needed to take one other position.
RP mentioned they obtained additional emails and cellphone calls from GCHQ asking how vetting was going, regardless of calling and emailing a number of occasions to substantiate they not wished the job.
UK Safety Vetting faces criticism
18 January 2023: The NAO reviews that UKSV’s document in delivering well timed clearances “continues to be poor” and longer-term efforts to rework safety vetting “have made little progress”. It finds that UKSV has failed to satisfy its targets for Developed Vetting since Could 2021, reaching its goal of processing Developed Vetting purposes inside 95 days in solely 7% of circumstances and failing to satisfy targets for follow-up checks on DV clearances. The NAO report finds that UKSV remains to be utilizing an IT system that it first mentioned it wished to desert in 2018 as a result of it lacked capability, was too gradual, and wanted too many guide workarounds to stick with it and operating.
12 Could 2023: The Cupboard Workplace has “didn’t get a grip” on the supply of nationwide safety vetting because it took over duty for safety vetting in 2020, in line with Parliament’s Public Accounts Committee. It finds that UKSV has failed to satisfy its predominant efficiency targets since 2021; almost a 3rd of Developed Vetting clearances in 2022 to 2023 took greater than 180 days to course of, virtually double the 95-day goal; and employees ranges had been 23% beneath estimated necessities.
RP makes software for senior IT position in MI6
1 April 2024: RP applies for a job within the Secret Intelligence Service (SIS), MI6.
19 June 2024: RP is obtainable a senior Grade 6 position within the Secret Intelligence Service and accepts the job topic to passing the Developed Vetting (DV) course of. RP is advised that it could take as much as 12 weeks for a member of the vetting crew to be in contact and is suggested to not make commitments which will pre-suppose a job supply.
June to October 2024: RP is anxious in regards to the lack of progress on finishing up DV checks and “politely leans” on folks to get the method transferring.
4 October 2024: SIS vetters interview RP following a sequence of delays. RP is shocked to be requested about their id as a member of the LGBT+ group and whether or not that may compromise their susceptibility to blackmail, however solutions the query professionally. RP discloses to vetting officers a personal e-mail tackle in a distinct identify utilized by RP for accessing Fb Messenger.
18 October 2024: RP completes home sale and prepares to maneuver to new position at SIS in London.
Cyber assault
23 October 2024: RP’s Fb Messenger Account is accessed from a pc with an unknown IP tackle. RP later makes use of the Whois area identify software which identifies the IP tackle as a US tackle with hyperlinks to the Russian Federation.
25 October 2024 – late morning: RP receives a notification from LinkedIn that an individual situated in Hanoi, Vietnam, has tried to reset their LinkedIn password. Two days later, LinkedIn briefly blocks RP’s account after detecting “potential unauthorised entry”. RP is later requested to confirm their id with authorities ID. The incident alerts RP that their e-mail tackle has been compromised.
25 October 2024: RP discovers that their e-mail account disclosed through the vetting interview has been compromised and that somebody has managed to alter the password regardless of RP utilizing a random unguessable password.
25 October 2024 – late afternoon: RP calls the SIS recruitment crew to report that they’ve been a sufferer of a cyber safety assault which has compromised the non-public e-mail tackle disclosed by RP throughout vetting with SIS.
26 October 2024: RP reviews the cyber safety incident by e-mail to the vetting crew. RP explains that that they had arrange the e-mail tackle to speak with an aged member of the family throughout lockdown on Fb and Fb Messenger, and likewise to authenticate their private YouTube channel. RP didn’t shield the account with two-factor authentication, pondering it unimportant, however acknowledges within the e-mail that it ought to have been protected. RP discloses that their Fb Messenger has additionally been compromised by an IP tackle which seems to be linked to the Russian Federation. RP encloses screenshots.
RP denied Developed Vetting clearance
29 October 2024: RP is shocked after FCO Companies writes to RP declining Developed Vetting (DV) clearance. The letter states: “I remorse that we’re unable for nationwide safety causes to supply suggestions on choices to grant DV.”
November 2024: RP writes to the chief of MI6, Richard Moore, asking why MI6 has denied them safety clearance with out talking to any of the senior civil servants, police colleagues or senior enterprise leaders supplied as character references. No reply is forthcoming.
3 November 2024: RP writes to the Overseas, Commonwealth and Growth Workplace, asking for particulars of the inner appeals course of for Developed Vetting purposes.
5 November 2024: RP emails the civil servants commerce union, FDA, asking for authorized recommendation. RP factors out that the union receives a stipend from MI6 to supply companies to MI6 employees who should not legally permitted to affix a commerce union. RP gives to pay any authorized prices.
5 November 2024: FDA writes again declining assist. The union states that as RP didn’t take up a submit in SIS, provided that employment was conditional on passing vetting, and isn’t a member of FDA, it can’t symbolize them.
6 November 2024: FDA assures RP that had RP been a member it could have supported RP, who’s a member of the LGBT+ group, no matter their sexual orientation. The FDA says that whereas SIS has had “an unpalatable historical past of questionable employment practices”, these ended “a long time in the past” and it not too long ago reaffirmed its inclusivity when the trans flag was flown over its constructing in 2021.
4 Jan 2025: RP submits grievance to the Investigatory Powers Tribunal (IPT).
9 Jan 2025: RP writes to overseas secretary David Lammy, asking him to look into an obvious lack of due course of within the vetting course of. No reply is obtained.
15 Jan 2025: IPT acknowledged receipt of grievance from RP.
