Case 031018. Request to the Department of the Environment, Heritage and Local Government for records relating to the electronic voting system - whether such release could make facilitate the commission of an offence - section 23(1)(c)

Case Summary

Facts

The request, in 31 separate elements, sought access to various records held by the Department of the Environment, Heritage and Local Government (the Department) concerning the electronic voting system. The electronic voting system for use in Ireland is comprised of voting machines supplied by Nedap Powervote and a software system (Integrated Election Software, or IES), supplied by an entity called Groenendaal. (Please note that the decision letter does not recite the request in full, but instead only details those elements thereof that were ultimately refused).

The Department partially granted the request, and refused access to some relevant records on the grounds that sections 26 (information supplied in confidence) and 27 (commercially sensitive information) of the FOI Act applied. It also charged a fee of €46.93 for the search and retrieval of the released records.

In the course of the review, a group of Dutch hackers hacked into a Nedap voting machine in Holland (similar to those intended for use in Ireland), and published a report of its work on the internet.

Decision

While the decision largely deals with the requester's contention that further records should exist within the Department, it also deals with the Department's refusal to release those records which it initially contended to be exempt under sections 26 and 27.

Although not a computer expert, having regard to submissions made by the Department, Nedap Powervote and Groenendaal, the Commissioner accepted the following:

• That it was a reasonable proposition that there was further information about the voting system as a whole, contained in the records at issue, beyond that which is available on the internet;
• That the Nedap-Powervote system, as it stands and as described in the records at issue, currently comprises the system that, as per comments made by the Minister for the Environment, Heritage and Local Government, is intended to be used in Irish elections in future;
• That it was reasonable that the release of such information could make it easier to interfere with the machines and related software that currently comprise the electronic voting system intended for use in Ireland.

Furthermore, the Commissioner accepted that it was a reasonable proposition that the release of any information in the records, which may confirm the completeness and/or accuracy (or otherwise) of any information available on the internet, could make it easier to interfere with the machines and related software that currently comprise the electronic voting system intended for use in Ireland.

As it is an offence under section 2(1) of the Electoral (Amendment) Act 2004 to, wilfully and without authority, interfere with any voting system equipment, the Commissioner accepted that the records were exempt from release under section 23(1)(c) of the FOI Act. Section 23(1)(c) provides that a record may be refused where access to it could reasonably be expected to facilitate the commission of an offence, and, generally does not require the consideration of the public interest. It does not, generally, require the consideration of the public interest (and did not in this review).

Accordingly, the Commissioner affirmed the Department's decision to withhold the records. Although she did not need to consider section 26 or 27 of the FOI Act in the light of that finding, she commented that she would accept section 27 applies to the records, and that the public interest (section 27(3)) would not warrant their release.

Date of Decision: 13.02.2007

Our Reference: 031018

13.02.2007

Mr. X

Dear Mr X

I refer to your application to this Office under the Freedom of Information Act, 1997 (the FOI Act) for a review of the decision of the Department of Environment, Heritage and Local Government (the Department) on your request dated 14 January 2003.

Please accept my apologies for the long delay that arose in completing your review. As has been explained in other letters from this Office, the delay has been due to a backlog of cases that arose from staff shortages in the early years of this Office, as well as the complexity of certain aspects of this review, and of other reviews of decisions on requests made by you to the Department.

Background

Your request of 14 January 2003 contained 31 separate elements. The Department's decision, dated 12 February 2003, released some records to you and, in relation to certain elements of your request, referred you to records that it had previously released to you. It also charged you a fee of €46.93, granted you access to certain testing records by inspection (which, according to the schedule to the decision, was on foot of your agreement to such inspection) and withheld other records on the grounds that sections 26 and 27 of the FOI Act applied. (I will list the refused records later in this letter.) The Department also consulted with third parties in relation to those records the decision on which is under review in case 030197.

You sought an internal review of the Department's decision on 10 March 2003, which the Department upheld on 1 April 2003. On 18 April 2003, you made your appeal to this Office.

In conducting my review, I have had regard to the above correspondence and to various correspondence between you and staff of this Office. As in the decision on case 030412, I will refer in this decision to only those arguments that you have made that I consider relevant to this review. I have also had regard to various correspondence between staff of this Office and the Department, and to various contacts between this Office and the suppliers of the voting system.

I have conducted this review in accordance with the provisions of the Freedom of Information (FOI) Act, 1997, as amended by the Freedom of Information (Amendment) Act, 2003. Accordingly, all references in this letter to particular sections of the FOI Act, except where otherwise stated, refer to the FOI Act, 1997 as amended.

Scope of Review

Records Outside the Scope of the Review

Records 2, 6, 7, 10, 11, 15, 27, 29, 30, 31(a), 31(b), 31(i) to 31(w)

The letter of 28 June 2006 sent to you by Ms Anne Moran, Investigator in this Office, explained why my review would not encompass the Department's decision on these elements of your request.

I do not intend to repeat her explanation here in any detail. I consider it sufficient to say that I concur with her view that there is no requirement for me to consider the Department's decisions on records that have been released to you, or on records that are covered by the scope of separate reviews by this Office, regardless of any views and wishes you may have to the contrary.

I also note that the record sought by you at part 1 of your request is the same record listed as relevant to part 31(c) thereof. Accordingly, I agree with Ms Moran's view that I need only deal with the issue of access to the record once, which I intend to do in relation to part 31(c) of your request only.

Records 3, 4, 5, 8, 9, 25, 26

The Department's decision in relation to aspects 3, 4, 5, 8, 9 and 25 of your request referred you to records it had already released to you. In respect of element 26, it told you that no relevant record exists.

Your letter to this Office of 1 July 2003 mainly referred to the application of section 6(9), the withholding of records under sections 26 and 27, the practices employed by the Department in dealing with your request, its refusal to list records, and its decision to charge a fee. This letter did not advert to any contention that the Department should hold further records relevant to elements 3, 4, 5, 8, 9 and 25 of your request, or that it should hold any records relating to element 26 thereof.

Mr Stephen Rafferty, formerly of this Office, specifically asked for your comments on the Department's view that it had already released to you all relevant records it holds in relation to items 3, 4, 5, 8, 9, 25, 31(a), 31(b) and 31(i) of your request, in his letter dated 24 March 2004. Your reply, of 20 April 2004, commented that the Department had not provided you with records in relation to these aspects of your request, and if the Department did not have them, it should obtain them from the suppliers further to section 6(9) of the FOI Act. In fact, you go on to say that "[t]he same rationale applies to all the other technical information I am still seeking. I agree that the Department may not have it in its possession but Mr Janson [Groenendaal] does".

In terms of element 26 of your request, you said that the Department had corresponded with various parties in respect of new releases of software, and that you had obtained copies of such records on foot of other requests. While you said that these should have been released to you on foot of this request, you did not specify that you contended the Department should hold further such records. However, you said that there may be a development schedule and timetable held by Groenendaal (suppliers of the IES voting system) which should be obtained via section 6(9) of the FOI Act.

Ms Moran took the view (quite reasonably, in my opinion) that you accepted that the Department did not hold further records of relevance to these elements of your request. The remainder of her letter of 28 June 2006, in relation to these aspects of your request, told you that this Office would consider the potential application of section 6(9). (You subsequently agreed to confine such consideration to case 040104).

However, your letter of 19 July 2006 said that Ms Moran's view did not consider that elements 3, 4 and 5 of your request concern records held by the Department as well as by Nedap. You said that elements 8 and 9 also concern Departmental records (in that "[s]tatutory counting obligations fall on the Returning Officers and any records with Departmental guidance to the ROs would be relevant here" and that section 6(9) does not apply at all. You also say that elements 25 and 26 also concern Departmental records, and that you have copies of emails between the Department and the developers relating to schedules for new versions of the software.

It is open to me to take the view that your letter of 20 April 2004 excluded from the review any records held by the Department which pertained to items 3, 4, 5, 8, 9 and 25 of your request. However, I accept that elements 8, 9 and 25 indicate that the relevant records should be held by the Department and not by a third party. Accordingly, I consider your comment that you agreed the Department "may not have [the technical information] in its possession" not to have been directed at such records. Accordingly, I will include them in my review.

I have also decided to include the issue of access to records relevant to aspect 26 of your request in my review, given that you had never specifically said you agreed that the Department might not hold such records. I note, however, that you did not indicate to this Office until July 2006 that you considered the Department should hold any records relevant to this aspect of your request or, indeed, further records relevant to elements 8, 9 and 25 thereof. I consider that it is reasonable to expect an applicant to be as clear as possible in his or her dealings with this Office, particularly where a review covers many different types of record, as to what elements of that applicant's original request have not been met to his or her satisfaction.

In respect of elements 3, 4 and 5 of your request, you firstly never indicated that you did not accept the Department's position that it held no further relevant records and then said that you agreed that the Department may not have them. You now seek to widen the scope of my review to include the possibility that the Department may hold such records. I would repeat my comments as to my expectation that an applicant should make it clear as to the elements of a decision that he or she is disputing. It seems to me that, in 2004, you limited the scope of my review to exclude these elements of your request. I consider that, once an applicant has narrowed the scope of a review, it is not reasonable to expect this Office to widen it again, particularly, as in this case, where a considerable amount of work has been undertaken on the basis of the scope of the application as limited by you the applicant. Accordingly, I do not intend to make a formal finding in respect of these elements of your request.

Records 23, 24

As your submissions to this Office of 1 July 2003 and 20 April 2004 had not taken issue with the form of access provided to records covered by elements 23 and 24 of your request, Ms Moran's letter of 28 June 2006 told you that they would not be covered by my review. Your letter of 19 July 2006 said that you had objected to the "manner in which inspection of these records took place".

While I note that your letter to this Office of 20 April 2004 indeed referred to your dissatisfaction with the facilities offered to you for the inspection of certain records, those records did not pertain to aspects 23 and 24 of your request. However, it transpired, from further enquiries made by Ms Moran, that you had never actually inspected those files considered by the Department as relevant to these elements of your request. Although you never raised this particular issue with my Office, I have decided to include the issue of whether the form of access to which you were granted to such records was in accordance with the FOI Act.

Record 28

I note that you commented, in your separate request to the Department of 21 November 2003, on a record released to you on 19 November 2003 that you felt should have been released to you on foot of this element of your request. However, based on your comments concerning "record 28", which were contained in your letter to this Office of 20 April 2004 with reference to records released in relation to "[p]arts 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 28" of your request, Ms Moran's letter of 28 June 2006 told you that it appeared that this element of your request had been met in full, albeit that release of record 28 had been delayed.

You pointed out, in your reply, that the "record 28" concerned did not actually correspond to part 28 of the request at issue. Again, this was not an issue you had raised with this Office prior to July 2006. However it is not clear to me if your comments indicate that you are satisfied with those records actually released to you in furtherance of aspect 28 of your request, and so I have included this aspect of the Department's decision in my review.

Summary of Records Covered by the Scope of the Review

Having regard to the above, my review is confined to considering whether the Department's decision in respect of parts 8, 9, 12, 13, 14, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 28, and 31(c) to 31(h) of your request appears to be in accordance with the FOI Act. Where I refer to a "record" in the remainder of this letter, that reference is intended to refer to any record or records (in whole or in part) considered by the Department to be relevant to the corresponding element of your request.

In my decision on case 030412, I explained the rationale behind various matters that are pertinent to an understanding of the scope of a review by this Office. I do not intend to repeat that commentary here, but in summary, it should be noted that:

• A review conducted under section 34 of the FOI Act will not take into account the practices and procedures in place in a public body for the purposes of compliance with the FOI Act;
• The decision by this Office is by way of a hearing de novo in the light of the facts and circumstances applying at the date of the review by this Office and not those facts and circumstances pertaining on the date of the original decision;
• Where a record is released at some stage subsequent to a body's decision on a request for that record, the fact remains that the record has been released and thus, the request has been granted;
• The potential application of section 6(9) of the FOI Act will be dealt with in this Office's decision on case 040104;
• A review can only be conducted of a public body's decision on records of relevance to a request that existed as at the date of that request.

In respect of any elements of your request where you contend that the Department should hold further relevant records, my review will consider whether the Department's position to the contrary is in accordance with the FOI Act. In so far as the application of section 10(1)(a) (the adequacy of searches for records of relevance to a request) might be relevant to any aspect of this review, the role of this Office in relation to such a review has been commented upon by Mr Justice Quirke, in the High Court case of Matthew Ryan and Kathleen Ryan and the Information Commissioner (2002 No. 18 M.C.A.), which is available on this Office's website at www.oic.ie . Quirke J. said he accepted that the then Commissioner's role did not require him to search for records. He said that this role was "... rather to review the decision of the Department and in doing so to have regard to the evidence which was available to the decision-maker and to the reasoning used by the decision-maker in arriving or failing to arrive at a decision."

Furthermore, I note that, in your letter of 19 July 2006, you refer to a number of procedural matters. I do not intend to address each such comment individually, but I am satisfied that Ms Moran's approach of dealing with case 031018 separately to that in 030197, and of not dealing with your applications in sequence of your requests, is not in any way negating your rights to seek a full and independent review by this Office of the decisions made by the Department on those requests.

Review of Decision to Charge a Fee

My review will also consider whether the Department is justified in charging you a fee in relation to the search for, and retrieval of, records pertinent to your request.

Findings

Decision to Withhold Records

Records 8, 9

These elements of your request sought:

8. Any record describing how the Department fulfils its statutory requirements under Section 44 - preliminary proceedings and time for counting of votes;

9. Any record describing how the Department fulfils its statutory requirements under Section 45 - application of part XIX of Principal Act.

Ms Moran's letter to you of 28 June 2006, in the context of outlining her preliminary views in relation to other aspects of your request, explained that the Franchise Section holds all files containing all relevant information in the possession of the Department relating to the project. She told you that the Department had said that these files contain documents originating from it, documents or correspondence from other parties involved in the development and roll out of the system, and copies of all relevant internal and external email correspondence on the project. She told you that the Department also said that where there are multiple copies of, and references to, the same information (e.g. in forwarded emails etc), generally only one copy is retained for reference on the file.

The Department's response to the request for record 8, as per the schedule to the decision of 12 February 2003, is that "preliminary proceedings and time for counting of votes are the responsibility of the returning officer. See Manual for IES users...". Its response to request for record 9 was that the count software was designed to implement the rules for the counting of votes set out in Part XIX of the Electoral Act, 1992 - to which the Count Rules Specification, PMI Code Review and ERS report are relevant.

In your letter to this Office of 19 July 2006, you say that, while statutory counting obligations fall on the Returning Officers, any records held by the Department giving guidance to the Returning Officers would be relevant to these aspects of your request.

The Department says that it considers the Powervote Voting Machine Operators Guide and the Direct Vote Recording/Electronic Vote Recording - Memorandum for Guidance of Returning Officers, Referendum Autumn 2002 to be relevant to these elements of your request. I note that these have been released to you.

The Department says that it holds three further versions of the former record that post-date your request. Although these are outside the scope of your request, I understand that the Department has now released these documents to you. The Department says it holds an earlier version of the latter record, dated April 2002, which it had not released due to its earlier view that release of the most recent version of a record was sufficient to address a request. However, I understand that it has now released this record to you. I also understand that it has released to you a circular regarding the Memorandum (enclosing substitute pages), a record that also post-dates your request.

With regard to your view as to the Department's own obligations, it said (on 7 November 2006) that, while sections 44 and 45 of the Electoral (Amendment) Act 2001 set out procedures to be followed by Returning Officers for the counting of votes after the closing of the poll, these are not statutory requirements on the Department. (Whether the provisions of that Act impose statutory obligations on the Department is not for me to decide.) The Department also says that it also holds copies of legislation within which the statutory requirements of Returning Officers are set out, which are available at www.irishstatutebook.ie.

The Department's position is that it has released to you all records it holds of relevance to these elements of your request, and that it holds no further such records. I have no reason to doubt its contention that this is the case. I uphold its decision in respect of the released records, and am satisfied that section 10(1)(a) applies to any further relevant records that you contend may exist.

Records 12, 13, 14, 16, 17, 18, 19, 20 and 22

These elements of your request sought:

12. Any record describing or commenting on module Memory_Read.pas/memory_Read.dfm;

13. Any record describing or commenting on module dmGen.pas;

14. Any record describing or commenting on module dmElec.pas;

16. Any record in the Department relating to Code Review #9 in "Powervote Response to Code Review of Integrated Election Software Build 2001-0096" where Developer comments read "We think you have a point here";

17. Any record in the Department relating to software to handle petitions;

18. Any record in the Department relating to Code Review #26 in "Powervote Responses to Code Review of Integrated Election Software Build 2001.0096" where the Reviewer states "several database operations take place ... without any exception handling";

19. Any record in the Department relating to Architectural Assessment # 2 in "Powervote Responses to Architectural Review of Integrated Election Software December 2001" where the Developer comments on "Primary Keys";

20. Any record in the Department relating to Architectural Assessment #3 in "Powervote Responses to Architectural Review of Integrated Election Software December 2001" where the Developer comments on "Referential Integrity";

22. A list of all regulations (including orders, SIs etc) signed by the Minister relating to Electronic Voting.

At the end of your request, you said "I wish to have a copy of all records in the Department which are relevant to the integrity of the ballot." I take this as a request for access via copy of all records relevant to the 31 parts of your request.

The schedule to the Department's decision referred you to a number of records it contended were relevant to aspects 12, 13, 14, 16, 17, 18, 19 and 20 of your request. It released to you a number of records pertinent to item 22.

Your letter to this Office of 1 July 2003 did not make any specific reference to your dissatisfaction with the extent to which the Department had released you records pertinent to these elements of your request. However, in your letter to this Office of 20 April 2004, you said that there were many records in the Department, mostly email records, which discuss the details of the topics raised by you in the elements of your request listed above. You said that the Department had not released them to you, but rather you found them on your examination of testing files. I understand that these were the five testing files - F427/9, F429/2, F431/11, F431/12 and F431/13 - to which you were given access by inspection in December 2003 in the context of your request of 10 October 2003, the decision on which was reviewed by this Office in case 040102. You also said that the facilities provided for your inspection of those files were inadequate.

On 28 June 2006, Ms Moran told you that the Department had said that, in relation to records that you contend should have been released to you by copy (which you said you had identified on your inspection of the five testing files), it may be that some of the documents referred to by you are incidental to the core issues as represented on the files. She told you it had also said that, at the time of your initial visit, the Franchise Section was preparing for the nationwide roll out of the e-voting and counting project and that all staff had extensive duties and responsibilities. Ms Moran told you the Department had said that, due to the limited space available in the Custom House and the need to oversee your inspection of the files to ensure that their integrity was maintained, the only suitable place was in the recessed lobby outside the Principal Officer's room. She told you it considered that, in such circumstances, it took all reasonable steps to facilitate your request.

Ms Moran's view, as set out in her letter of 28 June 2006, was that the Department gave you a reasonable opportunity to examine the files you had identified as containing further records relevant to these elements of your request.

In your reply of 19 July 2006, you said that you rejected the Department's comment about the records you had identified on your examination of the files being incidental to the core issues. You also disagreed that the facilities offered to you were adequate and referred Ms Moran to your letter of 20 April 2004. You then said that the Department should make a copy of each file you had previously inspected and send it to you, or "[a]lternatively, [you] would wish to take up the Department's offer to re-examine these files."

The Department continues to contend that it had previously released to you copies of all records it held at the date of your request that were relevant to these elements of your request. However, it agreed to your re-inspection of the five testing files you examined on foot of your request of 10 October 2003, although I understand that three of those files actually post date the request under review in this case.

I understand that you again inspected the five testing files concerned on 27 October 2006, and that you selected 28 records to be released to you by copy. The Department released 26 of the records in full to you, and withheld elements of the remaining two records (record 7 and record 9).

The withheld element of record 7 concerned the daily payment rate to a consultant, and the withheld element of record 9 concerned the personal mobile telephone number of a third party. Record 7 is dated 15 December 2003 and record 9 is dated 24 July 2003. Notwithstanding the Department's willingness to release to you records that post date your request, the fact remains that such release is outside of the FOI Act. Records postdating an original request are not covered by that request or, by extension, by any review by this Office on the decision on that request. Accordingly, I am not empowered by the FOI Act to make a finding in respect of the withheld elements of records 7 and 9 which you inspected in October 2006.

In summary, the Department's position is that it had already released to you those records of relevance to these elements of your request. While you disputed this, you have now again inspected the five testing files that you said contained further relevant records, and you have obtained copies of any records therein that you sought. (While two records therein were partially released to you, these were amongst those records that post-date your request and are thus not covered by that request.) As noted earlier, your letter to this Office of 19 July 2006 said, in respect of the issue of access to records relevant to aspects 12, 13, 14, 16, 17, 18, 19, 20 and 22 of your request, that an alternative to seeking access to paper copies of the testing files you had examined in 2003 was the further inspection thereof. Accordingly, I now consider these elements of your request to have been met in full.

I uphold the Department's decision in respect of the records it released to you under the FOI Act in respect of these elements of your request, accordingly. I also note that you have not made any further contact with this Office to advise of your dissatisfaction with the Department's response to this element of your request. Had I to consider the matter further, however, I would have no reason to doubt the Department's position that it holds no further records of relevance to these elements of your request, and accordingly, I would find that section 10(1)(a) applies.

Record 21

This element of your request sought a list of all records concerning the Counting System.

I note that the Department's decision released to you a list of files relating to the IES election count software. However, your letter to this Office of 1 July 2003 expressed dissatisfaction with this, and said that you were concerned that there were other records in existence of which you were not aware. In particular, you said that the Department had not replied to repeated requests for a list of records received from the developers concerned. You also commented that the Department's internal review letter had said that no records were received from the developers of the Counting System.

Mr Rafferty told you, on 24 March 2004, that the Department's records indicated, on foot of a telephone conversation of 28 January 2003, that you and the Department had agreed that this element of your request could be processed as a request for a list of files. You disagreed with this in your letter to this Office of 20 April 2004.

Ms Moran's letter of 28 June 2006 told you that the FOI Act did not require the Department to create a record in response to a request. You replied that a properly prepared FOI schedule should have listed all relevant records, and that this request had been made in response to the Department's poor response to earlier requests you made, which you said had not included comprehensive schedules. You said that the Department has a duty to list all relevant records in its FOI responses, and that such a schedule would have been the proper response to your request for record 21.

Firstly, while it is certainly good practice for public bodies to issue accurate schedules when informing a requester of a decision on a request, there is no provision in the FOI Act that requires a public body to do so. Thus, while my staff regularly encourage public bodies to issue accurate record schedules as an integral part of their FOI decision making, I do not have a statutory power to direct a public body to produce one, or to judge the quality of any schedule.

While it is open to a public body to create a record on foot of an FOI request, it should be noted that section 6 of the FOI Act provides for a right of access to be given to "any record held by a public body". Section 7 provides that a person wishing to exercise that right "shall make a request ... for access to the record concerned...". Therefore, I consider that the FOI Act provides a right of access only to records which already exist, and that it does not require the creation of records in order to grant a request.

You may contend that the Department had access to the information sought by you as at the date of the request, and that the FOI Act required it to create a record using that information. Section 12 of the FOI Act concerns the manner in which access may be given to a record. While section 12 refers to access being granted to a record by transcribing or decoding the information in a record, the language of that section suggests that the information that requires such transcription or decoding must be contained in an identifiable record. Accordingly, I am satisfied that a request for information is only a valid request under the FOI Act in so far as it may be construed as a request for access to an existing record that contains that information.

The Department says that, at the date of the request, it did not have a list of all records concerning the counting system, or (as specified in your internal review application) a list of documents that it received in response to the tender, or a list of documents that it received from the developers of the counting system. I have no reason to dispute this. Accordingly, I am satisfied that the Department is justified in relying on section 10(1)(a) in respect of this aspect of your request.

Although irrelevant to this review, it is not clear to me that the Department's internal review letter said that it had received no records from the developers of the counting system, as contended by you in your letter to this Office of 1 July 2003. Your internal review application specified, inter alia, that you wished to obtain a list of all documents, by title and date, received from the developers of the counting system, to which the Department's internal review decision replied that no records existed that matched your request. It seems to me that the Department was saying that it did not possess the list you had said you wished to obtain, rather than that it did not hold the records a list of which you wanted.

Records 23, 24

At these items of your request, you sought:

23. Any record in the Department relating to fixing the errors reported in the software;

24. Any record in the Department relating to regression testing of later releases of the software.

In the Department's decision letter of 12 February 2003, you were offered inspection of the files containing relevant records, and the attached schedule indicates that this had been discussed with you. However, I understand you did not avail of the Department's offer at the time.

The Department told this Office that the five testing files examined by you in 2003 (in the context of your request dated 10 October 2003 (i.e. F427/9, F429/2, F431/11, F431/12 and F431/13)) contain some records of relevance to these elements of your request. As set out earlier, you have inspected these files again (including the three that post-date this request), and obtained copies of various records therein.

The Department told this Office that further records of relevance to elements 23 and 24 of your request were held on those files to which it had offered you access on 12 February 2003. On 22 November 2006, the Department again invited you to inspect the latter files (i.e. F 427/1, F427/2, F427/3, F427/4 and F429/1). I understand that you inspected these files on 11 December 2006 and selected 44 records of which you wished to obtain copies. The Department fully released to you 41 of those records, and partially released to you records 6, 9 and 28 thereof.

I have examined the contents of records 6, 9 and 28. I am satisfied that the withheld portion of record 28 (a personal mobile telephone number) is the non-work related, personal information of a member of staff of the Department, which is exempt from release under section 28(1) of the FOI Act. Such release would amount to the disclosure of the personal information of an identifiable individual and I do not consider that there is any public interest in its release to you. I find that the Department was justified in withholding this element of record 28 of those examined by you in December 2006.

The Department contends that the withheld elements of records 6 and 9 contain detailed information about elements of the IES source code and that they are exempt from release under sections 23 and 27 of the FOI Act. I will deal with the application of these provisions to records 6 and 9, along with my findings in respect of elements 31(c) to (h) of your request, later in this letter.

Accordingly, all that remains for me to determine in respect of elements 23 and 24 of your request is whether the Department has considered all relevant records for release.

The Department submits that two of the testing files examined by you in 2003 contain records pertaining to this element of your request (the three other files post-date this request at issue in this case) as do the five testing files inspected by you in December 2006. Firstly, the number of seven relevant files is at odds with Mr Rafferty's letter to you of 24 March 2004, which told you that there were 16 testing files relevant to this element of your request.

Mr Rafferty's comment was based on the contents of a letter from the Department, dated 30 October 2003, which said there were 16 testing files of relevance to aspects 23 and 24 of your request. Ms Moran subsequently asked the Department to clarify the number of relevant files involved. The Department replied that it cannot account for the comments of 30 October 2003, as it is "not the case" that there are 16 relevant files, and says it can only surmise that this was "a typographical or administrative error". It also says that it is unable to establish why the relevant staff member referred to 16 files, as she no longer works for the Department. In the context of the Department's responses to Ms Moran's many other queries to it relating to this review, I accept the Department's position as reasonable, and have no reason to probe these comments further.

In your letter to this Office of 19 July 2006 in respect of elements 23 and 24 of your request, you said that an alternative to seeking access to paper copies of the testing files you had examined in 2003 was the further inspection thereof. As set out earlier, you have again inspected the five files you examined in 2003 (including three that post date your request), as well as the further five testing files originally identified by the Department as relevant to these aspects of your request, and have selected those records on all 10 files of which you wished to obtain copies.

I now consider these elements of your request to have been met in full. Accordingly, I uphold the Department's decision in respect of these elements of your request (again, the refusal to fully release to you copies of records 6 and 9 of those inspected in December 2006 will be dealt with later in this letter). I also note that you have not made any further contact with this Office to advise of your dissatisfaction with the Department's response to these elements of your request. Had I to consider the matter further, however, I would have no reason to doubt the Department's position that it holds no further records of relevance to these elements of your request, and accordingly, I would find that section 10(1)(a) applies.

Record 25

This element of your request sought any record in the Department relating to the fact that some of the software is written in Dutch.

I note that the Department's response to the request for record 25 was "none other than in documentation previously supplied". (I understand that the documentation concerned was a PTB report and a PMI report). In response to your view that the Department should hold further records of relevance to this element of your request, the Department has said that it holds no further such records. I have no reason to doubt its contention, and I find that section 10(1)(a) applies in respect of this element of your request.

Record 26

This element of your request sought any record in the Department relating to the schedule for new versions of the software.

The Department's decision said that there was "no schedule in the Department. When a final version of the software for multiple polls has been agreed, there will be a new release for each poll".

Your letter to this Office of 20 April 2004 said that the Department had had extensive and ongoing correspondence with Jan Janson and ERS regarding new releases of software, including specific discussions of when new releases were required for testing, work pressures on Jan Janson in meeting these deadlines, and notices of frequent releases of updated versions of the software with dates for delivery of same to ERS and Nathean for testing.

You said that these records were released to you via responses to other requests you had made, but that they were relevant to this aspect of your request, and should have been released to you accordingly.

The Department said that its interpretation of the text of your request was that you were seeking a record that set out the scheduled expected or issue dates for each new version of the IES software (an interpretation it still considers to be correct). It says that such a record does not exist within the Department, and that the development of a new version of the software did not occur in accordance with a formally established timetable in the matter suggested.

It is not for me to judge whether or not the Department should have held such a record. However, I would have no reason to doubt the Department's statement that it did not hold such a record, and I find that section 10(1)(a) is applicable to it. Whether or not such a timetable exists and is held by the relevant third party will be a matter for review in case 040104.

You contend that, in any event, the Department should have released to you all records on its files such as those you refer to above. The Department did not interpret this element of your request in such a way, and while I have considerable sympathy for why the Department interpreted this element of your request in this way, it should have nonetheless clarified the scope thereof with you before proceeding with its own interpretation.

However, I consider that to expect the Department to examine each record on the various files it holds for relevance to this element of your request would cause a substantial and unreasonable interference with the Department's work. I say this particularly in the light of the detailed nature of the various requests you had made to the Department and the length of time it has spent dealing with your requests and the reviews by this Office. As Ms Moran explained to you in her letter of 28 June 2006, albeit in the context of other elements of your request, section 10(1)(c) of the FOI Act provides that a request for a record may be refused if

"...granting the request would, by reason of the number or nature of the records concerned or the nature of the information concerned, require the retrieval and examination of such number of records or an examination of such kind of the records concerned as to cause a substantial and unreasonable interference with or disruption of the work of the public body concerned".

I find that section 10(1)(c) also applies to this element of your request, accordingly.

Record 28

This element of your request sought access to any record in the Department "relating to the use of more than 1 count pc". In a separate request to the Department of 21 November 2003, you commented on a record released to you on 19 November 2003, which you felt was relevant to this element of your request. It may be that you contend there are further records held by the Department that are of relevance to this element of your request.

Following queries from this Office, the Department said it considers the document "Guidance for Returning Officers - Technical Description Constituency Level (data transfer)" relevant to this aspect of your request, which I understand it has released to you. I also understand that it considers the various Memorandum for Guidance of Returning Officers documents, referred to by me under my findings in respect of elements 8 and 9 of your request, as relevant to this aspect of your request.

The Department contends that it holds no further records of relevance to this aspect of your request. I have no reason to doubt this contention, and I find that section 10(1)(a) applies to this element of your request, accordingly.

Records 31(c) to (h)

These records comprise the following:

31(c) Technical Requirements: Reliability of the Voting Machine ESI1, Document Version 1.1. RBW Teunissen October 2001;

31(d) Technical Specification: Nedap Voting System ESI1 Vote Storage, Document Version 1.2 RBW Teunissen (14-12 - 2001);

31(e) Hardware and Software Specification: Display Board, Voting Machine Ireland ESI1 (8-10-2001);

31(f) Hardware and Software Specification: Connection Board, Voting Machine ESI1 Ireland (5-10-2001);

31(g) Interface Specification Voters Panel and Main Processor Board, Voting Machine Ireland ESI1 (19-9-2001);

31(h) Hardware Specification Nedap Voting System ES I1: Vote Storage after Interrupt (Document version 1.0 RBW Teunissen, 19-10-2001).

As set out in Mr Sean Garvey's decision letter in case 030412, dated 2 November 2006, my review also encompasses the earlier version of record 31(d), dated 1 August 2001. It also includes the Department's refusal to fully release to you records 6 and 9 of those records you inspected on 11 December 2006 (pages 2-12 of record 6, and pages 9 to 13 of record 9 thereof).

The letter sent to you from Ms Moran, dated 10 October 2006, outlined her view that section 23(1)(c) of the FOI Act applies to the records 31(c) to (h). I consider her views, and your response, to be equally relevant to the earlier version of record 31(d), and to records 6 and 9 of those inspected by you in December 2006.

Section 23(1)(c) provides that a record may be refused where access to it could reasonably be expected to facilitate the commission of an offence. Ms Moran told you that, in the light of publicity concerning the hacking of Nedap electronic machines in Holland, she considered that the release of the information in the records could reasonably be expected to make it easier to interfere with the voting system equipment. She drew your attention to section 2(1) of the Electoral (Amendment) Act 2004, which provides that a person is guilty of an offence if they, wilfully and without authority, interfere with any voting system equipment. She also told you that section 23(1)(c) does not require the consideration of the public interest.

Your reply, of 2 November 2006, suggests that releasing the records cannot be reasonably expected to facilitate interference with the voting system equipment, or facilitate the commission of an offence.

You contend that the system had been so thoroughly reverse engineered by the Dutch group (with details thereof available on the internet) that additional information would make no difference to the ability of any person to interfere with the system, and you also say that the system is easy to understand because it contains standard components and processors. You say that the Government has accepted the recommendations of the Commission on Electronic Voting with regard to improving the security of the machines, and that these improvements (when implemented) will reduce the likelihood of interference. You said that no reasonable person expects the Nedap/Powervote system to be used in Ireland again, and therefore it is not reasonable to believe that any offence will be committed.

While you make a number of further arguments as to the merits in releasing the records concerned, it seems to me that these are more relevant to a public interest test, than they are to the issue of whether the provision itself applies to the record. In summary, however, I take it that your position is that the security of the electoral process would be improved, rather than adversely affected, by the release of these records and consequently the facilitation of the committing of an offence would be reduced.

Extent to which information may be contained in the records further to what is available on the internet

Firstly, I do not intend to debate whether or not the Dutch group committed an offence when they either "examined", "infiltrated", or "hacked" the machines in Holland.

You argue that there can be no information in the records that would make it any easier for the system to be interfered with than is already available on the internet.

Records 6 and 9 concern the IES. Firstly, I understand that it was the software in the voting machines that was interfered with, not the software in the IES. Although I did not invite comments in respect of records 6 and 9 from the supplier of the IES (Groenendaal), I had invited and received comments in relation to other records concerning the IES software, which I consider relevant to my consideration here.

On 14 September and 4 October 2006, Groenendaal submitted that access to the pertinent records could enable the re-engineering and reconstruction of aspects of its software. It said that this would not only infringe its intellectual property rights and prejudice its market position, but could facilitate the infiltration of the software to influence the outcome of elections. On 9 October 2006, following events in Holland, Groenendaal drew attention to the fact that the events in Holland involved the voting machine only and not the IES. It also referred to its previous argument as to the potential interference with the system that might be caused by release of particular records the subject of the consultation.

I do not profess to be a computer expert. However, the FOI Act requires that the public body that is refusing access to the records at issue or, in some cases, relevant third parties, must satisfy me that the records at issue should be withheld. It appears that Groenendaal's position is that release of the records would result in the disclosure of information that is not already in the public domain. Furthermore, the Dutch group's report said that it took only a "very cursory look" at the equivalent IES software in use in Holland. It is reasonable to accept that the information published by the Dutch group refers to the IES only on a superficial level and that records 6 and 9 (of those records inspected by you in December 2006) contain more information than that which the Dutch group made available on the internet.

The remaining records concern the voting machines. Nedap (the suppliers of the machines that were hacked), made a submission on 22 September 2006, in support of withholding records 31(c) to (h) which I consider to be equally applicable to the earlier version of record 31(d). It says that the release of the information in the records would threaten its competitive position in the technical and commercial areas, and could also be used to derive the internal design structure of the machines. Following the hacking in Holland, it said, on 13 October 2006, that the information in the records at issue "goes far beyond what these hackers have published." It refers to its earlier arguments of 22 September 2006 and says that its arguments are still valid, even after the publication by the hackers of some of the inner work details of its system.

While Nedap's argument is in the context of its view that section 27 of the FOI Act applies, I consider that its comments are also relevant to the application of section 23(1)(c) of the FOI Act to the records at issue. Having regard to the submissions made by Nedap, I accept it as a reasonable proposition that there is some information in the records at issue that goes beyond that which the Dutch group has made available on the internet concerning the voting machines.

In summary, therefore, I am satisfied that it is a reasonable proposition that there is further information about the voting system as a whole, contained in the records referred to here, beyond that which the Dutch group has published on the internet.

Extent to which release of such information could facilitate the commission of an offence

It is not for me as Information Commissioner to determine whether or not the Department should debate the security needs of this system with the general public in the light of the dissolution of the CEV, nor is it for me to determine whether "security by obscurity" is the correct approach for the Department to take in respect of the e-voting system. All I can review is whether or not the records are exempt under the FOI Act, which in this case means determining if the release of the records at issue could make it easier to commit an offence under Irish law.

The term "voting system equipment" is defined by the Electoral (Amendment) Act 2004 as being "any kind of mechanical, electro-mechanical or electronic apparatus for use in a voting system". At present, the Nedap-Powervote machines (and associated software), as described in the records at issue, comprise the apparatus for use in an Irish electronic voting scenario. While it may be your belief that no reasonable person expects the system to be used in Ireland again, the facts by which I must be bound are simple: the Government has not stated that it will not use the system again. I understand that the Minister of Environment, Heritage and Local Government has publicly said that the machines will be used at elections and referendums after 2007. Whether this transpires to be the case is immaterial to the decision I must reach. The fact is that the Nedap-Powervote system, as it stands and as described in the records at issue, currently comprises the system that, as per the Minister's comments, is intended to be used in Irish elections in future.

Section 2(1) of the Electoral (Amendment) Act 2004 makes it clear that it is an offence for a person to wilfully, and without authority, take, destroy, conceal, open or otherwise interfere with any voting system equipment.

It is not for me to determine whether the physical security in situ at venues at which the machines are stored is adequate to cope with the threat of interference with the machines. Equally, it is not for me to decide whether or not the system is already at risk of corruption from those to whom you refer to as "insiders" (the Minister, the Department and its officials, the manufacturers, the suppliers, the maintenance staff etc).

I have already set out why I consider there to be information in the records at issue further to that which has been published by the Dutch group. I accept it as reasonable that the release of such information could make it easier to interfere with the machines and related software that currently comprise the electronic voting system intended for use in Ireland, and thus facilitate the commission of an offence. I consider section 23(1)(c) applies to such information, accordingly.

Extent to which information contained in the records, that has been published by the Dutch group, could facilitate the commission of an offence

You suggest that the extent to which the Dutch group has reverse engineered the Nedap voting machines, and the extent to which such details are available on the internet, means that release of the records at issue could not make it any easier for the system to be interfered with, accordingly. I disagree with this view.

I accept it as reasonable that the release of any information in the records, which may confirm the completeness and/or accuracy (or otherwise) of the information so published, could make it easier to interfere with the machines and related software that currently comprise the electronic voting system intended for use in Ireland, and thus facilitate the commission of an offence. Thus, I consider that section 23(1)(c) applies to such information.

In summary, I am satisfied that section 23(1)(c) applies to records 31(c) to (h), the earlier version of 31(d), and the withheld portions of records 6 and 9 of those inspected by you in December 2006, in their entirety.

Section 23(1)(c) does not constitute a mandatory exemption in the sense that, once the elements necessary for its operation have been found to exist, the exemption must be applied. In this instance, I accept that the application of section 23(1)(c) to the records at issue is justified in order to protect the electronic voting system from being in any way interfered with.

Accordingly, I find that the refusal of these records in full, on the grounds that section 23(1)(c) applies, is in accordance with the FOI Act.

Public Interest

Section 23(1)(c) is subject to section 23(3) which provides that consideration must be given to the possibility that the public interest would be better served by the release of the information, rather than by the record being withheld, in the event that one of three conditions is fulfilled.

The first condition is that the record under consideration "discloses that an investigation for the purpose of the enforcement of any law...is not authorised by law or contravenes any law". I do not consider this to be the case. The second condition is that the record contains information concerning "the performance of the functions of a public body whose functions include functions relating to the enforcement of law"" and the third condition is that it contains information concerning "the merits or otherwise or the success or otherwise of any programme, scheme or policy of a public body for preventing, detecting or investigating contraventions of the law". The records do not contain any information that satisfies these conditions. Accordingly, I am satisfied that section 23(3) does not apply and that any records at issue are exempt from release to you under 23(1)(c) of the FOI Act. It follows that the public interest arguments made by you are irrelevant to my consideration of these records.

Having regard to my finding above, I consider that there is no need for me to consider section 27 of the FOI Act, although previous correspondence between this Office and yourself largely dealt with that particular provision. If I was required to consider that provision, however, I would find that section 27(1)(b) applies to the information at issue, and that the public interest, particularly that in safeguarding the system itself, would not warrant release of the records.

Findings - Decision to Charge A Fee

You cite the IES Database Validation report as an example of a record, relevant to a particular request, that was not released until you made a further FOI request specifically looking for it. You also say that the record was incomplete when it was released to you, and that it was only after an internal review request that you were given access to it in its entirety.

You say that the way in which access was granted to this, and other records, significantly delayed your consideration of the electronic voting system and caused you additional expense in repeated requests, internal review applications, fees for search and copying, and fees payable to this Office to appeal the multiple requests. You said that I should take this into consideration when deciding on the fees charged to you.

While I sympathise with the fact that you have had to submit specific requests to the Department for particular records that you contend should have been released pursuant to other requests you made, the fact is that a review under section 34 does not permit me to review the procedures in place in a public body to ensure compliance with the FOI Act. A review under section 34 enables me to review whether the body's decision - in this case a decision to charge you a fee and not exercise discretion to waive that fee - was in accordance with the FOI Act.

Your letter of 20 April 2004 says that no fee should be charged to you as it is of genuine importance to the Irish nation as to how its votes are to be cast, collected and counted. You cite the importance of particular records to an understanding of the system. You say that you consider the likely scenario, that the Minister and Department have agreed to allow a private Dutch company to hold as a trade secret the software with which the country's votes will be managed, as an unconstitutional decision. Accordingly, you say that all the information the Department has on the matter should be released and that "[w]e" should not have to pay for it.

The position in relation to the charging of fees under the FOI Act is set out in section 47 of the Act. Section 47(2) allows for the charging of a fee for the estimated cost of the search for and retrieval of the record concerned, and the estimated cost of any copy of the record made by the public body concerned for the requester concerned.

You have not, at any stage, disputed the basis on which the Department arrived at the fee it charged you in respect of your request. I have not assessed the merits of the fee arrived at by the Department, accordingly. Instead, you have said that a waiver of that fee was appropriate, having regard to the provisions of section 47(5) of the FOI Act.

Section 47(5) of the FOI Act provides that a head (of a public body) may reduce or waive a fee or deposit if, in the opinion of the head, "...some or all of the information contained in the record concerned would be of particular assistance to the understanding of an issue of national importance".

Mr Garvey's decision in case 030412 explained that his review would not consider the application of the phrase "a matter of national importance", particularly given the view that the Department would have made known its views should it have disputed your contention that the matter at hand was of national importance. This is also the case in this review. Furthermore, my review will also not consider whether or not the records at issue would be of particular assistance to the understanding of such a matter (a suggestion that the Department has also not disputed).

The Department's position would appear to be that, even where records the subject of a request might be of particular understanding to a matter of national importance, the decision maker still has discretion not to waive a fee. Thus, the scope of this aspect of my review will focus only on whether or not the Department's decision not to exercise its discretion and waive the fee it charged you, was in accordance with the FOI Act.

The wording of section 47(5) differs to the wording of section 47(1), which provides that an appropriate fee "shall" be charged to a requester. It is clear that the Act intends that requesters should be charged for requests for records that are voluminous in nature. While it is open to the discretion of the public body to waive or reduce such a fee, section 47(5) also refers to the opinion of the head of the public body. This does not mean that I must accept such an opinion but if I am to reject it there must be strong grounds for doing so.

The Department's submission of 7 November 2006 says that, while your request involved almost 14 days being spent on dealing with various aspects of this request, it charged you for just 2 hours for search and retrieval of records. The Department says that this was when the section concerned was under particular pressure with regard to the then proposed roll out of the system at the June 2004 polls. It says that the decision not to waive the fee was appropriate, in this context.

Having considered the matter, I consider such an approach to be reasonable and justified in the circumstances. I find that it was appropriate for the Department not to waive the entire fee concerned in this case.

Comments on Records 3, 4, and 5

As explained already, given that you had previously signalled your acceptance that the Department may not hold further records of relevance to these elements of your request, I do not intend to make a formal finding in respect of these records. But to assist you, Ms Moran made enquiries of the Department in respect of your contention of 19 July 2006 that the Department should hold records of relevance to these elements of your request, further to those it had released to you.

Ms Moran asked the Department to comment on your view that it should hold further records of relevance to these elements of your request. The Department says that all files held by Franchise Section were searched, both electronically and manually, for relevant records. It says that it considers the following records, which have already been released to you, to be relevant to this aspect of your request:

PTB Report with two enclosures; PMI Code Review of the Powervote Electronic Voting System; PMI Code Review of the Powervote Electronic Voting System Build 2001-0094; PMI Software's Pseudo-code for Code Reviewing; PMI Code Review Guidelines for Powervote Electronic Voting System; PMI Evaluation of Integrated Election Software Database; Nathean Code Review of IES Build 2002-0096 and Build 2002-0099; and ERS Report on Irish STV Software Testing.

It says that a further number of other records are relevant, which are available on the Department's website:

PTB Report 1: Testing of Integrated Election System; PTB Report 2: Voting Machines ESI2; Nathean Code review of IES Build 023; Nathean Code Review of IES Build 0132 Election Set up and Maintenance; Nathean Code Review of IES Build 0132 - Vote Reader; Nathean Code Review of IES Build 0111; and Nathean Architectural Assessment and Code Review of IES for use at June 2004 Elections.

Firstly, records that are available to the public (e.g. via the Department's website) are outside the scope of the FOI Act and, thus, my review. The Department's position is that it has already released to you all other relevant records, and that it holds no further records of relevance to this element of your request. If I were to make a finding in respect of this aspect of your request, I would have no reason to doubt this contention and accordingly, I would be satisfied that section 10(1)(a) applies to any further records of relevance to this element of your request that you contend may exist.

Decision

Having carried out a review under section 34(2) of the Freedom of Information Act, 1997 (as amended) I hereby affirm the decision of the Department in relation to those records the subject of this review. I also affirm its decision to charge you a fee in respect of the released records.

A party to a review, or any other person affected by a decision of the Information Commissioner following a review, may appeal to the High Court on a point of law arising from the decision. Such an appeal must be initiated not later than eight weeks from the date of this letter.

Yours sincerely

Emily O'Reilly
Information Commissioner