Select Committee on Defence Minutes of Evidence

Examination of Witnesses (Questions 127 - 139)




  127. Ms Craig, Mr Cochrane, Mr Clarke, you are welcome. I must apologise to anyone who stumbled upon this Committee. We will be doing something, if not unique, rather an aberration for us. We are having a short public session and then I am afraid we are going into a private session, although some of the information we elicit during the private session will be made available after the Ministry of Defence has rewritten it, which I suspect they will do fairly extensively—I do not mean rewrite but expunge Nixon-like nine-tenths of what has been said. However I still apologise in advance because we shall have to throw you out. Ms Craig, would you like to make a brief introductory statement—and perhaps while doing so you could tell us the difference between Director General Security and Safety and Director Defence Security; we are a bit confused about the difference. We know what the Ministry of Defence Police do.

  (Ms Craig) Perhaps I could start by telling you a bit about what we do so that you understand how we fit in. I am Director General of Security and Safety, so half of my responsibility is health, safety and the environment (but we are not talking about that today, I hope). The other side of my responsibility is as the Departmental Security Officer. In that I am responsible to Ministers for the organisation and maintenance of security across the MoD My role in that is to develop security policy, to set standards and to ensure that they are met across the MoD. In corporate governance parlance I am the person who provides the Permanent Secretary at the end of the year with a certificate of assurance that security risks are being properly managed. I am directly assisted in that security role by two deputies. One of them, Mr John Cochrane, sitting on my right, is the Director of Defence Security; he is responsible for developing security and for setting standards. There is another one who is not here today who looks after IT accreditation and audit. On my left is Mr Lloyd Clarke, the Chief Constable, and you know what he does. We also have some colleagues in the back row. I will not introduce them.

  128. Please do, we like to know who is who.
  (Ms Craig) If I can remember who they all are!

  129. I have caught you out! Perhaps they can introduce themselves
  (Ms Craig) I shall tell you in general how they fit in. The responsibility for implementing security risk management lies with the chain of command. So each top-level budget holder or TLB, as we will probably refer to them, and each Trading Fund Chief Executive is a risk owner. Each of those people is accountable to Ministers for ensuring that adequate security measures are carried out in their own area. Each of them is helped in the task of managing security by a Principal Security Adviser. There are 11 TLBs and four trading funds in the Ministry of Defence. We have not tried to squeeze them all in here today, you will be relieved to hear. But we have got five of them. May I introduce Brigadier Roger Brunt, who looks after the army, Air Commodore Clive Morgan, who is from the RAF, Mr Fred Wood, who looks after the Defence Logistics Organisation, Andy Gray, who looks after the MoD headquarters, and Mr Phil Betts, who looks after the Defence Procurement Agency.

   130. That is pretty impressive, I must say.
  (Ms Craig) We also have here Mr John Barton, who is sitting right behind me, from the MoD's Home and Special Forces Secretariat. He is here just to take a note in case there are any issues that arise that go beyond my own responsibilities, which are limited to the defence estate, which I gather you will be covering on 13 February.

  131. Thank you. Have ministerial responsibilities got any simpler or more complicated?
  (Ms Craig) They are still spread amongst the Ministers. Dr Moonie is the main minister who is concerned with security issues.[3]

  132. Could you send us a note on who is exactly responsible for what, please, because it is beyond comprehension.
  (Ms Craig) The ministerial responsibilities, do you mean?

  133. Yes. Did you want to say anything else?
  (Ms Craig) If I could just make a brief statement about what has been happening on the defence estate since 11 September, the first point I would make is that, as our memorandum says, the MoD has for many years had a high base-line of security which has been put in place in response to the long-standing threat from Irish terrorism. Awareness of the terrorist threat among both service personnel and MoD civilians has been at a high level and there are well-developed procedures for rapid changes in the alert state as well as maintaining liaison with the police and other civil authorities. But the 11 September, together with the subsequent anthrax incidents in the United States, caused us to look afresh at many of our security arrangements. On the ground, the top level budget holders have taken various additional measures to tighten up security at their establishments. Our memorandum cites a few of them. Centrally, I and my staff have been carrying out a number of reviews, either in conjunction with the Cabinet Office or with others in the MoD, into different aspects of security as and when we have identified the need. That work will continue because we are continuously reviewing and plugging gaps as we come across them in the security area. We would not, of course, want to give our opponents clues as to what some of our specific counter-measures are or where the gaps might be, so I hope the Committee will understand that there are certain limits to what we are able to discuss in a public forum but we will try to be as helpful as we can.

  134. Thank you. Perhaps you can tell us what the key planks of the new structure are and why the specific changes were needed.
  (Ms Craig) The first point is that this review dates back to 1999. I was asked to undertake it when I first took up my post at the end of 1999. It was approved by the Defence Management Board at the beginning of 2001 and came into effect on 1 April last year. In a nutshell what it aims to do is to bring security structures and management into the modern world. There had been an earlier review of security in 1994—it was one of the defence cost studies—which I actually undertook and that had started the process of modernising by doing a number of things. Notably it set up the Defence Vetting Agency as the purple body to carry out all the vetting on behalf of the armed forces and the civilian side, it abolished the four directorships of security policy that existed then and it produced a single manual for security which is called JSP 440, which I am sure we will refer to quite a lot today. But by 1999 there were several new drivers for change. First of all, the Strategic Defence Review had introduced an increased emphasis on joint operations, and there was also the Purple Defence Logistics Organisation, which was set up as a result of that, and in addition there was growing connectivity of our IT systems. All of those things together meant that we had to do things differently. In addition there were a number of things wrong with the old approach to security. In the first place, our structures did not really distinguish clearly between who owned the risk and who were the advisers on the risk. Secondly, the formulation of policy was spread across a number of areas. Thirdly, there was no independent audit capability and, fourthly, there was an incomplete understanding of risk management around the department. I might add to that, I sensed, certainly when I arrived back in the Ministry to do this job, that there was in some parts of the Ministry an unsatisfactory attitude towards security. There was a sense that people saw it as an irritating optional extra. So the key aim of the Security Structures Review was to ensure that security was treated as part of core business and not as an optional extra. One of the most important measures that we adopted was to do away with the old concept of security authorities; we replaced that with security advisers to the top-level budget holders. The top-level budget holders themselves were given letters of delegation, which made quite clear where the accountability for security rested. Each TLB and Trading Fund was given its own principal security adviser, although the armed forces chose to share three between six of them. We also brought together policy making in one body under John Cochrane and we also brought together the accreditation of corporate IT systems—the ones that crossed boundaries, which increasingly is the case—in a new organisation, the Defence Security Standards Organisation. Last but not least, we brought in an independent audit function under the DSSO, under me, so that we could have better oversight as to what was going on out there. That has been in place since 1 April, which is not very long, but I am generally very happy with the way it is working.

  135. If there were all these deficiencies in what had taken place hitherto, that is probably during the Cold War, we have to be relieved that we survived it if our security operations were in such need of fundamental reform (but that is a historical point and not a contemporary one). If I can follow this up, has the devolution of responsibility from the centre to the top-level budget holders been matched by a devolution of resources?
  (Ms Craig) Just to clarify, there was not a devolution of responsibility, because the responsibility was always with the TLBs in actual fact. What we did with the Structures Review was just to make that point clear and make clear within the TLBs who held the responsibility. By having these things called security authorities there was the tendency to think that it was the security people in charge; in actual fact the buck stops with the TLB holders and we have now made that clear. But the responsibility was always with them, it never actually was with the centre; the centre sets the standards but the responsibility for carrying out security has always been with the local commanders and the TLB holders

  136. There has been in the past some evidence that security being a grudge purchase is not just limited to the private sector but to cash-strapped top-level budget holders who are having difficulties in making ends meet and therefore security is something that potentially could be, if not relegated, somewhat downgraded in terms of what is spent now. What will you be able to do in the centre to ensure that that does not happen?
  (Ms Craig) I think that by placing the responsibility with them and by making the security advisers very clear about their own role, we will gradually find—and I think we are already seeing—a greater acceptance of ultimate responsibility. In the past what tended to happen was that the business managers (for want of a better word) would say "I would like to do something" and the security authorities would say "No, you can't do that because the rules don't allow you". There was often a debate between them but that was the relationship. What we are trying to get much clearer now is that it is the security adviser's job to tell the business managers how they could do something safely and what the risks would be if they were to do it. So we would expect a much more intelligent debate taking place, so that the security advisers would say "Yes, do it this way, but these are the risks, this is how you might mitigate them and this is the residual risk that you would be left with; it's now up to you to take the decision". In practice what we have found is that the business managers then become a lot more cautious about taking a decision, because they hold the responsibility.

  137. Will the centre be allocating marked funds specifically designated for security or will that be up to the top-level budget holders?
  (Ms Craig) They each have their own budget, but what I am doing on top of that is to institute an audit function, which has not yet got going—it is still in the pilot stage—but that will be keeping a close look at what the TLBs are actually doing.

  138. Would you expect them to use all the money allocated to them for security or will there be any temptation for them to syphon off some money in security and put it into something else?
  (Ms Craig) Money is not actually allocated in that way. If they needed to make security enhancements they would bid for those measures to the centre; they would find the money either within their own budget or they would have to bid centrally for it.

  139. Can the advisers appeal over the heads of their bosses to you or to somebody?
  (Ms Craig) Yes, they do not have any direct line of responsibility to me but I would expect that if any of them had any problems with what their business managers were doing, they would come to me and pray me in aid. That has not happened yet, but they all know they could do that if they felt they needed to.

3   Note from Witness: Minister (Armed Forces), Mr Ingram, is the main Minister who is concerned with security issues, while Parliamentary Under-Secretary of State, Dr Moonie, is responsible for MDP operations. Back

previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2002
Prepared 7 March 2002