To ask His Majesty's Government what steps they are taking to ensure that non-UK citizens who have access to information classified as sensitive to the national security of the UK or its allies, during their employment in the public service or with contractors to the Government, do not subsequently communicate such information to the government of their country of citizenship.
Answered on
3 November 2022
Everyone who works with Government (including staff, contractors and service providers) has a duty of confidentiality and a responsibility to safeguard any HM Government information or data that they access, irrespective of whether it is marked or not, and must be provided with appropriate training. Access to sensitive information must ONLY be granted on the basis of a genuine 'need to know' and an appropriate personnel security control.
All Ministry of Defence personnel sign the Official Secrets Act Declaration upon employment and must complete annual mandatory security training which includes how to handle all Defence information.
Information passed to partners should only be provided to international organisations, foreign governments, and their commercial or industrial entities, in cases where: There is a clear need to know; The international partner has demonstrated both the ability and willingness to protect UK classified information; and appropriate protective security arrangements have been agreed with the recipient.
Any decision to provide UK classified information to international partners must be taken on a risk managed basis by departments and agencies, noting that the threats to information may differ from those in the UK.
For UK contractors, the prior approval of the relevant Department or agency must be obtained before HMG classified assets are released overseas.
Roles with access to sensitive information may also require the postholder to have an appropriate national security vetting clearance; as part of that process applicants’ ongoing overseas connections will be considered, and if a risk is identified as a result of such connections additional risk mitigation will be considered.
Additionally, caveats are used - the caveat UK Eyes Only is intended to limit access to UK nationals. Further information can be found in the May-2018_Government-Security-Classifications-2.pdf (publishing.service.gov.uk)