Independent review of Scottish Government's use of mobile messaging apps and non-corporate technology

2. Executive Summary

2.1 The Scottish Government is the devolved government of Scotland and was formed in 1999 as the Scottish Executive following a referendum on Scottish devolution held in 1997. Like every organisation, it collects, creates, uses, and stores a vast amount of information, all of which is governed by legislation, policy and guidance.

2.2 The UK Covid-19 Inquiry (the Inquiry) has brought the information practices of governments across Scotland, England, Wales and Northern Ireland into sharp focus. There was extensive media coverage and a great deal of public anger at the picture that began to emerge as the Inquiry hearings progressed. The picture was consistent across the UK. WhatsApp became a feature of almost every hearing and every media story, and it was clear that this had been the communication platform of choice at the very heart of government.

2.3 On 25^th January 2024, the then First Minister of Scotland, Humza Yousaf, announced that he had commissioned an externally led review to investigate the use of mobile messaging applications and the use of non-corporate technology in the Scottish Government^[6]. This followed extensive political and media interest as well as a significant amount of public criticism of the way governments across the UK had used non-corporate communication channels (NCCCs), particularly during the pandemic.

The announcement came at the same time Mr Yousaf spoke at the UK Covid-19 Inquiry –

"And perhaps on this issue of informal messaging, including of course WhatsApp messages, let me reiterate what I have said in the Chamber just a couple of hours ago. Let me unreservedly apologise to this Inquiry but also to those who are mourning the loss of a loved one, that was bereaved by Covid, for the government's frankly poor handling of the various Rule 9 requests in relation to informal messaging, messages. There is no excuse for it, we should have done better, and it's why I reiterate that public apology today"^[7]

And in the Scottish Government's closing submission to the Inquiry, it states - "It is clear to the Scottish Government that it must learn lessons in this area."^[8]

2.4 This review is, therefore, an opportunity to reflect on what has happened and offer a number of recommendations to the Scottish Government as they look to build the lessons learned into their operational and strategic activities. The terms of reference are set out in Appendix 1.

2.5 It has been a short and focussed piece of work. The aim is to provide a clear, realistic, and meaningful set of recommendations which can be implemented across all areas of the Scottish Government.

2.6 The review has at all times been mindful of the ongoing UK Covid-19 Inquiry and the Intervention by the Office of the Scottish Information Commissioner. Whilst there are inevitably some areas of overlap, it is hoped that the recommendations in this review will contribute positively to those wider areas of statutory activity.

2.7 This review is non-statutory and has no power to determine civil or criminal liability or impose sanctions. It is focussed on positive lesson learning and future improvements.

2.8 For most of the community, the use of instant messaging is now embedded into everyday life. We think very little, if at all, about the nature of the platform, the ways it is changing the way we interact, or the risks that we may be exposed to. But government must be held to higher standards and the questions of governance that necessarily arise need to be carefully considered.

2.9 Every day, government departments handle significant volumes of information and what happens to that information is of profound importance. The Inquiry has illustrated the critical role that information plays and the damage that can be done when it is missing, incomplete or otherwise unfit for purpose. It has also highlighted the relationship between government behaviours and trust.

2.10 This is a stark reminder that information and records management is not, as it is sometimes portrayed, about inconsequential, dusty filing cabinets; it gets to the heart of how government conducts itself, the relationship it has with its citizens, and the democratic values we hold dear.

2.11 This review is intended to support the Scottish Government in learning the lessons from what has happened, enabling it to look to the future with a clear and deliverable strategy which will help start the process of repairing the damaged trust.

2.12 The observations and recommendations are based on information provided and discussions held throughout the review. Many will be of relevance to others in the public sector and all those who have the privilege of calling themselves a holder of public office or a public servant are encouraged to consider the issues raised carefully.