Independent review of Scottish Government's use of mobile messaging apps and non-corporate technology

6. The pandemic

6.1 As highlighted above, information is a critical element of all statutory inquiries. The Inquiry set up to investigate the way in which government handled the Covid-19 pandemic has been no different.

6.2 The Inquiry has been provided with extensive information from the Scottish Government, including a significant number of WhatsApp messages from Ministers and officials. This followed a Section 21 notice (under the powers of the Inquiries Act 2005). The content of those messages is a matter for the Inquiry and this review does not seek to comment on them beyond to note that it evidences the extent of the use of MMAs, particularly WhatsApp, by Ministers and officials both in the Scottish Government and throughout the UK.

6.3 It must be noted that the approach the Inquiry is taking has moved governments to a very different position in light of the information that has been requested which goes beyond that which should be held because it has 'corporate value'. This change is highly significant in the context of the issues raised in this review. During the pandemic, Ministers created records directly by messaging another Minister whereas previously they would have spoken with each other and relayed the details to officials to be duly recorded.

6.4 Reviewing the Inquiry documentation so far also provides insights into the approach and culture of government across the UK during the pandemic.

6.5 There was little to evidence a consistent and widespread knowledge, understanding, or application of the policies that were in place around the use of MMAs, including rules around retention, exportation, and deletion. None of those who appeared at Module 2A of the Inquiry appeared particularly strong on knowledge of the MMA policy.

6.6 Inquiry evidence has also highlighted the subjective nature of the decision-making surrounding these messages. The Scottish Information Commissioner made the following comment in his Witness Statement to the Inquiry - "I recognise that the decision as to what requires to be transcribed to the document management system is subjective."^[14]

6.7 The policy required individuals to 'transcribe the salient points of any business discussions and/or decisions in a mobile messaging app into an email or text document using the SCOTS platform and save this to the Electronic Records and Document Management system (eRDM).' This is clearly open to interpretation.

6.8 In the absence of any information about how much or how often such transcribing took place, it is impossible to take any comfort from the policy. It nonetheless seems clear that, particularly at a time of heightened pressure for all those involved, the process was unwieldy and surely likely to increase the likelihood of 'post completion error.'[15] (Byrne & Bovair, 1997) whereby individuals neglect to take required steps after a particular main task has been completed.

6.9 What also became clear during the early sessions of Module 2 of the Inquiry, was the way in which the environment (of informal messaging) encouraged behaviours and conduct that would not be acceptable in other contexts. The 'online disinhibition effect'^[16] (Cheung, Wong & Chan, 2016) has been well documented: "The Internet has changed the way we communicate and interact with other people. Individuals loosen up and feel less restrained to say or do things in the online space that they would not ordinarily say and do in the offline environment. This online disinhibition effect has been found to be associated with online aggressive and deviant behaviours." Evidence of this has been seen throughout the Inquiry hearings.

6.10 The Lead Counsel to the Inquiry at one point warned that because of the WhatsApp messages, they were going to have to 'coarsen their language,' and the 24-hour news channels found themselves hastily warning listeners and viewers of the offensive language as those messages were read out. The BBC news website continues to warn readers that articles relating to the Inquiry contain language some readers may find offensive.

6.11 The Lead Counsel to the Inquiry also said, "[Y]ou will of course exercise considerable caution when assessing the worth of the WhatsApps. They were often sent in speed, were largely informal and spontaneous, and were sometimes ill-considered." It points to the fact that we tend to treat these communication channels as informal conversations rather than official records. Discussions that may have, in the past, been had 'around the water-cooler' have increasingly moved online (particularly during the pandemic) but the way we engage with them has yet to catch up. It should come to no surprise to anyone that the public and media reacted the way they did.

6.12 It is also the case that boundaries between the personal and professional are easily blurred in such an environment. It is unsurprising that the lack of clarity and governance combined with the demands for Ministers and officials to work at pace and often 'out of hours,' resulted in a mixing of the home and work lives of those involved.

6.13 It has been evidenced that the messages requested by, and handed over to, the Inquiry contain communications of a private nature. The then Deputy First Minister confirmed, during a meeting of the Parliament on 31 October 2023 -

6.14 'In examining the messages that were collated, it was clear that a number of them were of a particularly personal nature, including photos of individuals' children and personal medical details. In order to reconcile our obligations as data controller for the contents of the messages with our desire to co-operate fully with the inquiry, the Scottish Government wrote to the UK inquiry on 5 October requesting a section 21 notice to provide the necessary legal basis for providing the information within the messages.

6.15 "The Scottish Government received the section 21 notice yesterday. I can confirm that work is well under way to comply fully, in accordance with the timetable that has been set by the UK inquiry. That will mean that all requested messages that are held will be shared, in full and unredacted, by 6 November."^[17]

6.16 The Inquiry will review these messages and in due course come to its conclusions. For those Ministers and officials who have been required to provide information which may be of a personal and private nature, this will have been a sobering reminder of the fact that our online activities are anything but ephemeral. The impact on them, as well as on others who may be included in the message conversations, must be acknowledged. This could include family and friends and for Ministers, who must navigate the different roles they are required to perform, information about constituents may also be included.

6.17 A clear picture started to emerge at the time of the earlier hearings of the Inquiry that the use of informal communications was entirely routine throughout all areas of all governments, including right at the very top.

6.18 The pandemic brought with it unprecedented challenges for the whole country. Being able to communicate quickly and reliably was, of course, critical for those working in government and other key areas.

6.19 Significant change normally requires planning, but the speed of developments at that time did not allow for that. Whilst it may be easier to have some sympathy for the circumvention of certain rules or governance structures at the start of a crisis, those procedures and controls become even more important at times of significant stress precisely because the stakes are higher. It therefore cannot be acceptable for the changes to remain in place without proper scrutiny and review. What may be 'normal' at times of crisis are rarely appropriate to be 'normalised' afterwards.

6.20 That is the reason effective business continuity planning (BCP) needs to be embedded into all organisations, especially those whose role becomes pivotal at times of crisis or emergency, including the public sector. We rarely have time for critical thinking in times of pressure and stress, so procedures need to be in place, effectively communicated, and well-rehearsed.

6.21 The review has not found evidence of MMAs or NCCCs being included or referenced in business BCP for the Scottish Government.

6.22 The Inquiry heard from the then National Clinical Director for Scotland that he used his "personal device for messaging on WhatsApp and iMessage for simplicity and ease"^[18] but considers that he did so in accordance with the policy. The list of individuals with whom he had 'WhatsApp connections' was long and contained some of the most senior civil servants and politicians across the UK.

6.23 It is worthy of note that there is also evidence of extensive use being made of other 'informal communication channels' such as direct messaging on 'X' (formerly Twitter). This has not received the same degree of attention, but care should be taken to understand the whole picture. Information could reside on other platforms, including social media.

6.24 In December 2023, the former head of GCHQ, Sir David Omand, called for an end to the government handling of crisis over WhatsApp. "Covid rationale no longer applies, if it ever did. It is essential to have proper decision-making process if we are to survive a crisis in good order"^[19]

6.25 In January 2021, Gillian Mapstone (Head of Records and Archives Engagement at the National Records of Scotland) wrote an article in the IRMS Bulletin^[20] in which she highlighted concerns around the widespread cessation of records management work (because of the pandemic), with expertise and knowledge being 'sacrificed in favour of speed'. Prophetically, she talked of her concerns around "uncontrolled + unmanaged + unstructured data = unsafe data," inadequate governance, and uncontrolled record keeping environments.

6.26 During a radio discussion relating to the government response to the pandemic, a member of the public called in to say – "I have a question about WhatsApp and its use in the UK government specifically. How will we gain access to data that is stored on a device that may not exist or be accessible in 10 years, let alone 30 years, when it's not stored in a controlled, archived environment? How do we stop important information about decisions being accidentally, or on purpose, deleted and should we be worried for history and transparency?" ^[21] This again points to the wider public concerns that are clearly still felt.

6.27 The Scottish Government acknowledges that responding to public inquiries is now an embedded feature of 'business as usual.' In both the 2021 Review of Information Management, and the 2021 Information Strategy, reference is made to the fact that responding to inquiries is now a "constant and permanently embedded feature of Scottish Government's 'business as usual' environment, and the need for them to be 'held to high standards".

6.28 As has already been highlighted, the single most crucial element of any inquiry is information. This needs to be a driver for improvements to be made.

6.29 The Inquiry has received tens of thousands of WhatsApp messages which are likely to be unstructured and relating to both the professional and personal lives of those involved, as well as third parties.

6.30 In July 2023, the UK government failed in its court challenge to a notice issued by the Inquiry requiring the disclosure of WhatsApp messages between Boris Johnson and others. This clarifies that inquiries are to be provided with all information, and it is for them to determine relevance. This is further evidence of the need to embed high standards of records management governance and discipline both for 'business as usual' purposes, as well as to support potential future inquiries. It is recognised that the breadth of information now in scope for the Inquiry (and likely all future ones) was largely unanticipated. This change necessarily meant that Ministers may not have had the same levels of training in policy and process that civil servants were given in relation to some aspects of the records management detail. This highlights the need to react expeditiously and holistically to developments of this nature.

6.31 Public inquiries cost money and take time. If those in positions of leadership and influence fail to ensure high standards of governance and discipline around information, this will be consequential for the inquiry costs, processes and outcomes. This is something which the Scottish Government has clearly identified itself. As they take this opportunity to reflect on events that have occurred, this reality must be embedded into the governance frameworks across the whole organisation.