Case 040104. Request to the Department of the Environment, Heritage and Local Government for records relating to the electronic voting system, including records held by third parties outside of the jurisdiction - whether there exists contracts for service on foot of which the third parties were obliged to provide records to the Department - section 6(9) - whether, if such records were not forthcoming, the third parties could be required to provide records further to section 37 of the FOI Act - whether records relating to the deliberative process in respect of "tallyman data" should be released in the public interest - sections 20(1) and 20(3) - whether release of records could make it easier to interfere with the voting system and thus to commit an offence - section 23(1)(c)

Case Summary

Facts

The request sought access to various records held by the Department of the Environment, Heritage and Local Government (the Department) relating to the electronic voting system, including records held by all parties who are or were providing a service for the Department under a contract for services.

Neither the Department nor the supplier of the electronic voting system (the Nedap Powervote consortium, based in Holland) accepted that there existed between them a contract for service. Accordingly, the records held by the consortium were not provided to the Department. Another third party (Kema), did not provide any records, while a further third party, (PTB), refused to provide certain of the records held by it. The Department accepted there existed contracts for service between it and the latter two parties, however. Kema and PTB are based in Holland and Germany, respectively.

Decision

The Commissioner considered that, even if there exists contracts for service, she could not enforce any section 37 notice that she might issue to the service providers concerned, on the grounds that she was not aware of any mechanism by which the FOI Act is legally binding outside of the jurisdiction. She also did not consider that it was practicable to issue a section 37 notice to the Department seeking it to take legal action to require provision of records held by such third parties, as all she was empowered to do was to request the Department to make reasonable efforts to enforce any contractual rights that may exist. She also went on to say that she considered it a matter for the Courts to decide whether or not to hold the Department criminally liable if the latter took the view that taking legal action was not a reasonable means of enforcing any contractual rights that might exist.

In these circumstance, she did not make a finding as to whether or not there exists a contract for service between the Department and the suppliers of the electronic voting system, or in respect of those records that Kema and PTB had refused to provide.

She also rejected the Department's refusal to release records concerning its deliberations on the "tallyman data" issue, and upheld its refusal of records the release of which she accepted could facilitate interference with the electronic voting system.

Date of Decision: 16.11.2007

Our Reference: 040104

16.11.2007

Mr X

Dear Mr X

I refer to your application to this Office under the Freedom of Information Act, 1997 (the FOI Act) for a review of the decision of the Department of Environment and Local Government (the Department) on your request for records concerning the e-voting project, dated 24 November 2003.

Again, please accept my apologies for the long delay that arose in completing your review. As you know, this has been due to a backlog of cases that arose from staff shortages in the early years of this Office, as well as the complexity of certain aspects of this review, and of other reviews of decisions on requests made by you to the Department.

Background

Your request, dated 24 November 2003, sought the following:

1. A copy of all records sent or received since 24 September 2003 to/from the suppliers of the electronic voting system;
2. A copy of all records sent or received since 24 September 2003 to/from the reviewers of the electronic voting system;
3. A copy of all records relating to the electronic voting system which under section 6(9) of the FOI Act are in the possession of a person who is or was providing a service for the Department under a contract for services. You said that there were many records held "by TNO and PTB in this category";
4. A copy of all records sent or received since 24 September 2003 to/from the Institute of Public Administration relating to the electronic voting system;
5. A copy of internal Departmental records created since 24 September 2003 relating to the electronic voting system;
6. A copy of those records refused in request FOI 2003/271 which are no longer subject to section 20(1);
7. A colour original, or a soft copy, of a particular record;
8. Any record in the Department dealing with Ballot Module failures;
9. A copy of any DTP of any date payable to Powervote UK, Powervote (Ireland), Powervote Services, Nedap, PMI, Nathean, ERS or other suppliers or reviewers.

The Department's decision, dated 9 January 2004, set out that it considered 116 records to be of relevance to your request. It charged you a fee of €243.78, and withheld from you records 60, 61, 75, 76, 78, 104 to 111, 113, 114 and 116 in full (record 116 being used to denote what the Department described as "records held by PTB and TNO on electronic voting") and records 28 and 29 in part (the withheld portions thereof being third party names, according to the Department's schedule to its decision.). Your internal review application, dated 6 February 2004, sought a review of the Department's decision on the records you listed as "60, 61, 75, 76, 78, 104 to 111, 113, 114, and 119". (It appears that the Department took your reference to "record 119" as being an incorrect reference to those records it had designated as "record 116" and proceeded on this basis). The Department's internal review decision, dated 27 February 2004, told you it was releasing records 76 and 78 to you and was upholding its refusal of the remaining records.

You made your application to this Office on 4 March 2004. In conducting my review, I have had regard to the above correspondence, to correspondence between yourself and this Office, and to correspondence between this Office and the Department. In respect of your submissions, I will refer in this decision to only those arguments that you have made that I consider relevant to this review. I have also had regard to various correspondence between this Office and third parties, to copies of those withheld records of relevance to your request that were originally held by the Department, and to copies of those withheld records of relevance to your request that were supplied by third parties, either to this Office or to the Department in the course of this review. It should be noted that, where third parties provided copies of records directly to this Office, further copies were supplied to the Department in order for it to determine its position with regard to the release or otherwise of such records.

I have conducted this review in accordance with the provisions of the Freedom of Information (FOI) Act, 1997, as amended by the Freedom of Information (Amendment) Act, 2003. Accordingly, all references in this letter to particular sections of the FOI Act, except where otherwise stated, refer to the FOI Act, 1997 as amended.

Scope of Review

Of the above withheld records, on foot of various contacts from Ms Anne Moran, Investigator in my Office, the Department agreed to release to you records 75, 104, 106, 107, 109, 110, 111, 113 and 114 in full, and records 105 and 108 in part.

Your letter to Ms Moran of 21 August 2006, along with asking Ms Moran to follow up on particular records that you had not received but which you had been told would be released to you (which I understand have now been sent out to you - the delay having been due to an oversight on the Department's part), specified that the records "remaining for attention" at that stage were records 60, 61 and 116 of those withheld from you by the Department.

Accordingly, my review will be confined to assessing whether the Department's refusal to release to you records 60 and 61 in their entirety, as well as the Department's refusal to release records relevant to part 3. of your request (those records it had designated as "record 116") is in accordance with the terms of the FOI Act.

Scope of the Review in respect of "Record 116"

As agreed by you in your letter to my Office of 21 August 2005 in respect of case 030412, my review of the Department's decision in respect of "record 116" will include the Department's refusal to release to you records that, in the course of other separate reviews, you had said should have been released to you further to the provisions of section 6(9) of the FOI Act. I am satisfied that the wording of point 3. of your request of 24 November 2003 encompasses such records.

In particular, you contend that Nedap-Powervote holds records of relevance to your request that should be provided to the Department in the first instance under section 6(9) of the FOI Act. The records you have said Nedap-Powervote should hold include (but are not limited to) a quality plan; a software development schedule and timetable; the Nedap Technical Documentation CD; the Powervote Style Guide; various security and reliability assessments of the voting machines and counting machines; the source code; development documentation; specifications of the counting programme and database; and design standards used in programming the system. The Department disputes that a contract for service exists.

Accordingly, part (i) of this element of my review will address your contention that the arrangement between the Department and Nedap-Powervote is a contract for service by which any records held by Nedap-Powervote that are of relevance to your request may be accessed further to section 6(9) of the FOI Act.

I note that the Department's initial decision in respect of "record 116" appeared to consider your reference to PTB (Physikalisch-Technische Bundesanstalt) and TNO (the Netherlands Organisation for Applied Scientific Research), in item 3. of your request as listed above, as limiting the scope of that aspect of your request to records held by these entities. Ms Moran considered this aspect of your request to be broader than that interpreted by the Department, and advised the Department to this effect. The Department now accepts that this element of your request was not intended to be confined to only those records held by TNO and PTB, and that it was intended to seek access to records held by those entities and by any other entity who is or was providing a service for the Department in respect of the electronic voting project under a contract of service. Accordingly, it sought copies of records held by a number of third parties, that it accepted provided it with services under a contract for service (reviews of the system, etc) pursuant to section 6(9) of the FOI Act.

I understand that PTB and ERS (Electoral Reform Services) failed to respond to the Department's request, while Kema told the Department it could not take up the request and that it should refer to Nedap for further information.

PMI (part of the Project Management Group)/Nathean, Zerflow, TNO and the Local Government Computer Services Board (LGCSB) supplied the Department with the relevant records they hold. Ms Moran's letter to you of 20 April 2007 told you that a number of the records concerned would not be covered by the scope of my review, given that they were created after the date of your request, or were already in the public domain, or had already been released to you on foot of other FOI requests. In summary, she told you that none of the records provided by PMI/Nathean, Zerflow or TNO would be covered by this review. Your reply of 15 May 2007 did not raise any objections to this and so I do not intend to list, refer to, or consider such records further.

Ms Moran's letter of 20 April 2007 listed those records that are relevant to my review as follows:

Record L102 (which the Department fully withheld from you) and records L73, L87, L100, L106, L108, L113, L115, and L121 (all of which the Department partially withheld from you). All of the records concerned were provided to the Department by the Local Government Contracts Supply Board, and were designated by the Department with the letter "L" in order to distinguish them from other records covered by this review.

The Department subsequently confirmed that record L106 had already been released to you on foot of an earlier FOI request (Department's reference 2003/271, the decision which was appealed to this Office in case 040102). I do not intend to consider this record further.

Ms Moran's letter to you of 20 April 2007 set out various reasons as to why my review would not encompass records L87, L108, L113 and L121. You did not object to this, and accordingly, these records will not be considered further.

On foot of contact from Ms Moran, the LGCSB indicated that it did not object to the release of the details contained in the remainder of record L100 (which comprises unit costs as quoted by the LGCSB to the Department). Also on foot of contact from Ms Moran, Eurokom Limited (which has taken over Zerflow) indicated that it did not object to the release of record L102 (a systems security proposal submitted to the Department by Zerflow in June 2003 but which was in the LGCSB's possession). I understand that these records have now been released to you and I do not propose to deal with them further.

Thus, part (ii) of my review will consider the refusal by the Department to release to you the remaining records it received from the LGCSB further to section 6(9) of the FOI Act (i.e. records L73 and L115).

Ms Moran sought copies of relevant records from PTB, ERS and Kema, to which Kema did not respond. Part (iii) of my decision will, therefore, address the failure by Kema to supply records either to this Office or to the Department.

ERS provided this Office with copies of ten records, while PTB provided copies of 220 records. As noted earlier, further copies were, in turn, provided by my Office to the Department.

Ms Moran's letter to you of 3 July 2007 told you that of the records provided by ERS, the Department was releasing one to you; another seven post-date your request (of which two are reports that are already in the public domain); a further record was a copy of one that was released on foot of your request in case 030412; and the final one was a copy of a record that had been partially released to you on foot of your request in case 031018, the redaction of the details of which you did not object to at that time. She told you that it appeared to her that there was nothing to be reviewed in this case in respect of those records provided by ERS. You did not object to this, and accordingly, there is nothing for me to consider further in respect of the records provided by ERS.

Ms Moran's letter to you of 14 August 2007 described the extent to which PTB had sent records to this Office (the majority of which I note the Department released to you). She listed those records that my review would not encompass, namely those records already released to you on foot of this or other reviews, or records available online. I do not intend to list the records concerned in this letter. She told you that my review would assess whether you are entitled to access to the remaining records provided to this Office by PTB, as follows:

Category A: Records A65, A66, A95 and A96;

Category D: Records D1 and D35.

Part (iv) of my decision will consider the Department's refusal to release the above six records.

Finally, any reference in the remainder of this record to a "record" may be taken as a reference to the withheld portion(s) of such a record, where applicable.

Before I outline my findings, I will also deal with the question of submissions. Ms Moran's letter to you of 25 May 2006 in respect of case 030412 set out her views in respect of the Nedap-Powervote contract, to which she referred you in her letter of 20 April 2007 in respect of this case. In your reply, you said that the latter correspondence did not set out Ms Moran's preliminary views on the matter, and that you wanted to know what they were at that time in order to allow you an opportunity to address them. You said you were particularly keen to have her views on your comments on elements of her letter of 25 May 2006, and that you wanted to know the arguments put forward by the Department as to the application of section 6(9).

Quirke J., in the recent High Court appeal by Parents for Justice in respect of my decision in case number 050380, noted that the review required by section 34 of the Act was intended to be inquisitorial rather than adversarial in nature and that the procedures to be adopted by me in respect of such reviews are entirely within my discretion provided that they do not offend recognised principles of natural and constitutional justice. Quirke J. said that "...there was no principle of natural or constitutional law or justice which confers upon parties who make submissions to a decision-making body the right to respond to the submissions made by every other party who participates in the process." He went on to note that each of the parties who participated in that review was provided with "full and equal access to the Commissioner and her officials."

Accordingly, my approach in dealing with reviews under section 34 of the FOI Act is to allow all parties to a review an opportunity to put forward submissions in support of its case. This may require more than one contact between my Office and a public body, to ensure that I am fully aware of all relevant facts to a case, and to try to persuade a public body to change its mind in respect of records it had previously withheld. Equally, there may be occasions where an Investigator may liaise with a requester more than once, for example as in this case, where the requester's views on further records that have come to light have not previously been sought.

However, the final decision on an application rests with myself (or my authorised official), and in formulating that decision I have regard to the views of my Investigator, and to the submissions of the requester, the public body and any appropriate third parties. In short, I consider that once a requester has had an opportunity to comment on a particular issue (whether on foot of an invitation to make a submission following my Office's acceptance of a case, or whether on foot of any preliminary views letter that may be issued), there is no need for my staff to engage in continuous debate with requesters on those comments.

Accordingly, I am satisfied that there was no need for this Office to engage in a protracted debate with you as to the merits of your argument in respect of the application of section 6(9) vis a vis Nedap-Powervote.

I also note that you have not replied to certain of Ms Moran's letters. Nonetheless, I am satisfied that you have been given a reasonable opportunity to put your views in relation to all aspects of this case, and accordingly, I take the view that you have nothing further to add.

Finally, I note that your letter of 15 May 2007 said that Ms Moran's listing of the records you had suggested should be held by Nedap-Powervote should not be the limit of those records under review. In this regard, I note that Ms Moran's letter made it clear that my review would have regard to the arrangement between the Department and Nedap-Powervote and determine whether section 6(9) applies in the first instance, the decision on which would impact on whether or not you are entitled to gain access to the records listed by you as possibly being held by Nedap-Powervote, and "to other records held by Nedap Powervote that are relevant to your request." It is clear that Ms Moran was not attempting to limit the scope of this aspect of your request in any way.

Findings

Records 60 and 61

The Department has relied on section 20(1) of the FOI Act in respect of these records, which are concerned with the issue of whether, and/or to what extent, tallyman data should be made available in an e-voting scenario. As discussed in the decision that issued on your application in case number 040102, section 20(1) provides that a request may be refused where the requested record contains matter relating to the deliberative processes of a public body (including opinions, advice, recommendations, and the results of consultations, considered by the body, the head of the body, or a member of the body or of the staff of the body for the purposes of those processes).

Section 20(2) provides that subsection (1) does not apply to a record if and in so far as it contains, inter alia, "factual information", and section 20(3) provides that a record to which section 20(1) has been found to apply may still be released if the public interest would, on balance, be better served by granting rather than refusing to grant the request.

In the course of this review, the Department referred to submissions it had made to this Office in other cases involving the withholding from you of similar records under section 20(1) of the FOI Act, particularly what it termed as the "policy sensitivities" surrounding the issue, "the likely negative impacts of release on the decision making process as previously stated" and the "fact that this issue is not yet resolved" in support of its position. In July 2006, when other decisions issued from this Office in respect of records concerning the tallyman data issue, the Department's position was that deliberations with regard to tallyman data had not progressed since the date of your original request. However, it told this Office, on 12 September 2007, that the new Minister for the Environment, Heritage and Local Government has been working to formulate his position with regard to the electronic voting project, and amongst the issues to be considered is that pertaining to tallyman data.

When asked to explain how the contents of records 60 and 61 would impact on deliberations concerning the tallyman data issue if released now, the Department referred this Office to previous submissions (specifically those of 6 and 26 July 2006 - I presume that the latter is a reference to its submission of 27 July 2006 in respect of the case at hand) which had already set out the "sensitive policy considerations" relevant to decision making on the future generation and dissemination of tallyman data.

A number of decisions have issued from this Office, particularly that in respect of case 040102, that found that the Department had not demonstrated that the public interest warranted the protection of such records, even if they were exempt under section 20(1) of the FOI Act. In particular, the decision in case 040102 outlined the contents of the submissions made by the Department including those of 6 and 27 July 2006 concerning the instant case, in respect of which I said:

"It is not enough for a body merely to assert that the decision making process on a certain matter would be affected detrimentally without clearly setting out how this might transpire. I would expect the public body to be able to elaborate on how, and to what extent, its decision making process might be affected by the release of the information in question. Equally, if there are "sensitive policy considerations" at play, I would expect the public body to set out not only what those considerations are, but what the impact thereon, by release of the record at issue, might be. "

I went on to say that:

"It was open to the Department to set out, in response to Ms Moran's questions and her views, a detailed explanation of how its deliberations could be negatively impacted upon through release of the records concerned. I also consider that, while there might indeed exist "sensitive policy considerations" as to whether (or to what extent) tally data might be released on a statutory basis, the Department should have set out clearly why release of the records at issue might impact detrimentally on those policy considerations. In my view, the Department has done neither.

On balance, in my view, the Department has failed to set out to my satisfaction why the public interest should warrant the withholding of the record at issue."

I find that the same considerations apply to records 60 and 61 in this case. In particular, the Department has not provided me with any detail as to the effect that the release of records 60 and 61 might have at this point in time on either the "policy sensitivities" it has referred to, or on its decision making process in respect of the tallyman data issue, and thus why the public interest requires the protection of the records. Thus, I find that the Department has not demonstrated that records 60 and 61 should be withheld further to section 20(1) and I direct that they be released to you.

"Record 116"

As set out in the section headed "Scope of the Review", there are four aspects to this element of the review i.e.

(i) your contention that the arrangement between the Department and Nedap Powervote is a contract for the supply of services, by which any records held by Nedap-Powervote that are of relevance to your request may be accessed further to section 6(9) of the FOI Act;

(ii) the refusal by the Department to release to you the two remaining records of those it had received from the LGCSB further to section 6(9) of the FOI Act;

(iii) the failure by Kema to supply records to the Department;

(iv) the refusal by the Department to release to you the six records provided to this Office by PTB.

(i) The Nedap-Powervote Contract

The Department, in its submission to this Office on 12 May 2006 in respect of case 030412 was that "[t]he structure of the tendering consortium is that Nedap provides the electronic voting hardware equipment and Powervote (also known as Groenendaal) provide the election management software used to programme the machines and count the votes."

I note that the contract of 19 December 2003, of which you have a copy, sets itself out as being between the Suppliers (being Powervote Ireland Limited and Nedap NV), and the customer, being the Minister for the Environment. It provides an agreement, in Clause 2 thereof, for the supply of "Ordered Equipment", "Project Services" (described in Schedule 3 of the contract) and "Support and Maintenance Services" (set out in Clause 7 of the contract).

The "ordered equipment" is defined by the contract as comprising "the items of Equipment including the Embedded Software to be supplied by the Suppliers to the Customer..... as identified in Schedule 1." The "Embedded Software" is defined in the contract as being "the software contained within the Ordered Equipment and licensed to the Customer in accordance with this Agreement." Accordingly, the "Embedded Software" is an integral part of the ordered equipment, which is specified in Schedule 1 to the contract as being 6000 voting machines, various numbers of ballot modules and programming units. Schedule 1 also provides for the upgrade of the 1006 machines that had been previously supplied to the Department. I understand that the "ordered equipment" is provided by Nedap.

I note, however, that the definition of "ordered equipment" in the contract does not refer to the provision of the Integrated Election Software ("IES"), also referred to as Election Management Software or the "EMS".

In relation to the case at hand, Ms Moran sought further detail from the Department as to its comment of 12 May 2006 to the effect that "... Powervote (also known as Groenendaal) provide the election management software used to programme the machines and count the votes." The Department, on 28 September 2006, clarified that "Powervote Ltd and Groenendaal BV are not the same."

The Department said that Groenendaal BV and Nedap had joined together in a business partnership for the purpose of implementing electronic voting in the Netherlands with the former providing the integrated election software and Nedap providing the voting machines and associated peripherals. It said that Powervote Limited was formed to exploit market opportunities for the EMS in the UK, and that this entity did the initial tendering and project work in the Irish context. It said that "[o]nce the decision was taken by the Government to purchase the system, Powervote Ireland was formed comprising Groenendaal and the Ireland/UK agent, Mr Roy Loudon."

It would appear that the actual supplier of the software is Groenendaal, therefore, as opposed to Powervote Ireland Limited, which is one of the parties to the contract of 19 December 2003.

I also understand, from an article in the Irish Times (dated 2 February 2007), that Powervote Ireland Limited has gone into voluntary liquidation and that all rights, liabilities and obligations of Powervote Ireland Limited arising from the contract have been transferred to an entity called Powervote Services Limited, which I understand is a company registered in Ireland. I have not sought details from the Department in relation to this. Both Nedap and Groenendaal are based in Holland.

From correspondence received from Nedap and Groenendaal in the course of this review, it is apparent that they do not accept that there exists a contract for service between them and the Department. It follows that records held by them have not been provided to the Department. Even if I were to seek the records from Nedap or Groenendaal pursuant to a notice under section 37 of the FOI Act, (and leaving aside the issue of whether or not there actually exists a contract for service between the Department and these entities, on which the appropriateness of such a notice is dependant) I am not aware of any mechanism by which section 37 of the FOI Act is legally binding in Holland. It would seem to me that issuing a section 37 notice to either Nedap or Groenendaal would be futile, in those circumstances.

I have also noted the involvement of Powervote Ireland Limited in the contract, its voluntary liquidation and the apparent transfer of its contractual obligations to Powervote Services Limited. While the Department has said that Powervote Ireland Limited was comprised of Groenendaal and the Ireland/UK agent, Mr Roy Loudon, I am unaware of the legal structure of Powervote Services Limited. I do not intend to probe this matter further as, in any event, I do not believe that the Oireachtas intended me to determine complex matters of contract law, which would be required in order to determine whether a section 37 notice served on Powervote Services Limited (or even on Powervote Ireland Limited) should compel the Dutch entity Groenendaal to provide me with records relevant to your request. Accordingly, I have neither sought records from, nor issued a section 37 notice to, Powervote Services Limited or Powervote Ireland Limited.

You might contend that the Department should take legal action for breach of contract against Nedap, Powervote, Groenendaal, Powervote Services Limited or Powervote Ireland Limited on foot of their failure to supply records to the Department. This would presumably be based on the grounds that section 6(9) inserts a clause into the relevant contract that obliges the contractor concerned to supply the Department with records relating to the service it performed. It should be noted that it is up to the Department to take legal action for any breach of contract that arises from non-provision of records to the Department by the parties to any contract for service that may exist. Given the Department's view that there does not exist a contract for service between it and the entities concerned, I consider it unlikely that it would take such legal action.

You might also consider that I should issue a section 37 notice to the Department that would require it to exercise any contractual rights it may have in respect of the suppliers of the electronic voting system. Even if the Department accepted that there exists such a contract for service, I consider that a notice issued under section 37 of the FOI Act could not specifically require the Department to take legal action to seek to obtain the relevant records. I am of the view that all I could seek it to do is to make reasonable efforts to enforce any contractual rights that may exist.

In summary, this is a situation where neither the Department nor the relevant entities accept that there exists a contract for service on foot of which records may be obtained further to section 6(9) of the FOI Act. If a decision were to issue from this Office upholding your view in respect of section 6(9), and assuming that such a decision was either not challenged, or was challenged and found to be correct by the Superior Courts, I have no power under the FOI Act to either obtain the relevant records from the third parties concerned, or to require the Department to do so. Having regard to these considerations, I do not propose to make a finding as to whether or not there exists a contract for service between the Department and the suppliers of the electronic voting system.

(ii) the refusal by the Department to release to you the two remaining records of those it had received from the LGCSB further to section 6(9) of the FOI Act

As set out in the section of this letter headed "Scope of the Review", the records at issue here are records L73 and L115 (both of which were partially withheld from you).

In respect of record L73, the Department has withheld the default PIN number to the USB key on the grounds that its release would facilitate interference with the voting machines. It says that the USB keys were circulated to Returning Officers (ROs) in advance of the planned nation-wide rollout of the system in June 2004. It says that, under normal circumstances, a default PIN would be used for the first access of a hardened PC with the ROs then choosing their own PIN for subsequent access. It says that with the nation-wide rollout having been abandoned, many ROs have not even unpacked their hardened PCs, let alone used the USB keys to log in. Given that the Department cannot be sure that all of the PINS were changed from the default position, it contends that the default PIN number should be withheld, as access to it could facilitate interference with the machines.

In her letter to you of 20 April 2007, Ms Moran told you that, while she was making further enquiries of the Department as to whether or not the default PIN number is still current, she would accept the Department's position that its release would make it easier to interfere with the voting system equipment if it did transpire to be current. You did not take issue with her view in that regard.

Having regard to the Department's comments, it would appear that it is possible that the default PIN number could still be current in some cases. Thus, I consider that release of the default PIN could make it easier to interfere with the machines concerned, which is an offence under section 2(1) of the Electoral (Amendment) Act 2004. Section 23(1)(c) provides that a record may be refused where access to it could reasonably be expected to facilitate the commission of an offence. While section 23(1)(c) is a discretionary exemption, I accept that its application to the PIN number concerned is justified in order to protect the electronic voting system from being in any way interfered with.

I find that section 23(1)(c) applies to the withheld portion of record L 73.

The withheld portion of record L115 comprises a personal mobile phone number. I agree with Ms Moran's view that this constitutes personal information of the individual concerned, which is exempt under section 28(1) of the FOI Act (which provides for the refusal of records containing personal information) and that there is no public interest in its release.

I find the remainder of record L 115 to be exempt from release to you under section 28(1) of the FOI Act.

(iii) the failure by Kema to supply records to the Department

You have suggested that the Department take legal action against Kema (also based in Holland) on foot of its failure to supply records to the Department, on the basis that this amounted to a breach of the clause, effectively inserted by section 6(9) of the FOI Act into the contract between it and the Department, that obliges Kema concerned to supply the Department with records relating to the service it performed.

Ms Moran sought the Department's views on your suggestion, and it said that it does not propose to engage in such litigation, for a variety of reasons on which I do not propose to elaborate here. As discussed earlier, I consider that I have no power under the FOI Act to require the Department to take such action, and that issuing a section 37 notice to the Department would be futile.

Ms Moran also wrote to Kema, in her letters dated 22 May 2007 and 14 June 2007, in which she sought all records held by it that relate to the service it supplied to the Department in relation to the electronic voting project. As at the date of this decision, no response has been received. As I have noted above, I am of the view that as section 37 of the FOI Act has no effect outside of Ireland and that I have no power to enforce any notice under that section that might be issued to a company based outside of the jurisdiction. Accordingly, I do not intend to take further action in respect of any relevant records that might held by Kema.

(iv) whether you should be entitled to access to the six remaining records provided to this Office by PTB

Firstly, the letter sent by PTB that accompanied the 200 records it provided to by Office on foot of contact by Ms Moran, also adverted to material such as source code and other "technical documentation", and other records that reproduce parts of the source code and technical documentation, that it was refusing to provide in accordance with its non-disclosure agreements. Ms Moran asked it to clarify whether it would provide such material to this Office for the purposes of this review, and advised PTB that providing the material to this Office did not necessarily mean that they would be released to the requester concerned.

PTB replied that it is "a German governmental institute and as such has it has to comply with the respective German laws and regulations", and accordingly, that "[n]o further provisions of records are possible."

It is evident that PTB is not willing to provide further material to this Office voluntarily. For the reasons outlined earlier, I consider it futile to issue a notice under section 37 of the FOI Act, to either the Department or to PTB, in respect of this material. Accordingly, I shall not consider further the issue of the source code, technical documentation, and other records that reproduce parts of the source code and technical documentation, as held by PTB.

The seven records, provided by PTB to this Office, that the Department has not released to you in full, are as follows:

Category A: Records A65, A66, A95 and A96; and

Category D: Records D1 and D35.

The Department has partially released records A65, A66, A95 and A96 on the grounds that the withheld portions are exempt under section 23(1)(c) of the FOI Act (a code and a password in the case of A65 and A66 respectively, and serial ID numbers of particular machines listed in records A95 and A96). It has also partially withheld records D1 and D35 on the grounds that the withheld portions (hardware IDs and checksum codes and voting machine ID numbers, respectively) are exempt under section 23(1)(c) of the FOI Act. It claims that the various withheld details could make it easier to interfere with the machines and thus to commit an offence, thus that section 23(1)(c) applies (previous decisions from this Office have set out the wording of section 23 of the FOI Act and the relevant excerpt of the Electoral Acts; I do not intend to repeat those details here).

The Department claims that the release of the serial numbers of hardware such as those of the voting machines or ballot modules would make it easier for those who wished to infiltrate the system to substitute a modified piece of hardware for a legitimate item. In respect of the checksum codes, it explains that the results of checksum tests are compared to these codes, and thus that to reveal the expected answers of the checksum tests would allow those who wished to infiltrate the system a means to achieve a desired electoral outcome while still generating the expected result of the checksum test to hide the interference. The Department has also claimed that access to a password for access to a zipfile of the source code could make it easier to interfere with the source code. I accept the Department's position, and in relation to the zipfile password, would add that this is on the basis that, should the zipfile concerned fall into the wrong hands, knowledge of the password could make it easier to interfere with the source code.

Being satisfied that release of the remaining elements of the PTB records could make it easier to interfere with the voting system, and such interference being an offence under the Electoral Acts, I am satisfied that section 23(1)(c) applies, and that the Department was justified in exercising its discretion to rely on the provision concerned.

Decision

Having carried out a review under section 34(2) of the Freedom of Information Act, 1997 (as amended) I hereby vary the decision of the Department in this case.

I annul the Department's decision in respect of records 60 and 61 as originally held by the Department and direct that they be released to you. In respect of "record 116", I do not intend to make a finding in respect of the records held by the Nedap Powervote consortium or by Kema, or in respect of those records that PTB refused to supply to this Office (namely the source code, technical documentation, and other records that reproduce parts of the source code and technical documentation, as held by PTB). Finally, I affirm the Department's refusal of those remaining PTB and LGCSB records that have been withheld in part from you.

Right of Appeal

A party to a review, or any other person affected by a decision of the Information Commissioner following a review, may appeal to the High Court on a point of law arising from the decision. Such an appeal must be initiated not later than eight weeks from the date of this letter.

Yours sincerely

Emily O'Reilly
Information Commissioner