Lobbyists access parliamentary emails using IT loophole

Unlock the Editor’s Digest for free

Roula Khalaf, Editor of the FT, selects her favourite stories in this weekly newsletter.

Lobbyists who previously worked as aides in the House of Commons have accessed confidential information from parliamentary email systems because Westminster authorities failed to close their accounts after they left.

Two ex-aides to MPs told the Financial Times they logged in to access the private contact details of MPs and their staff after they had taken up jobs at lobbying firms.

One said they had been asked by their new boss at a lobbying firm to use their continued access to Commons IT systems to get private email addresses that are not available to the public.

“They would ask me to go in and get email addresses from the internal systems for the six weeks I still had access after leaving,” the ex-aide said.

Others said they were able to see emails sent to their former MP’s inbox, which would have enabled them to see confidential constituent information as well as the parliamentarian’s private messages.

The ex-aides also said the access would have enabled them to see security information circulated to MPs and staff in parliament.

The revelations suggest the parliamentary authorities are failing to properly secure private or confidential information, even after a high-profile China spying scandal.

In April, a UK parliamentary researcher and another man were charged with spying for China after allegedly providing information that could be “useful to an enemy”.

The two were accused of giving “articles, notes, documents or information” to a foreign state, according to the Metropolitan Police. Both pleaded not guilty on Friday.

Parliament has different bodies responsible for various parts of its operations. The Independent Parliamentary Standards Authority (IPSA) handles payroll for MPs staff, but the aides are legally directly employed by their MPs. IPSA is separate from Parliamentary Digital Services, which handles email systems.

Two ex-aides said parliamentary authorities did not automatically close email accounts when a staffer’s employment ended.

“To close an account, the MP or office manager has to inform Parliamentary Digital Services directly the person has left,” one of the aides said. 

“If the MP is disorganised, or just a new MP with limited training on running their office, then it’s very possible that an account may remain for months until security clearance expires,” they added.

A third former staffer added: “You go through such a rigorous security process to get your pass, it’s mad they don’t restrict access to parliamentary accounts as soon as you leave.

The Labour party, which swept to power at the July UK general election after 14 years in opposition, last month privately warned its parliamentary staff about the risk of access by ex-employees.

It said in an email to all Labour parliamentary staff that it was “vital” that staffing records were kept updated so that anyone who had left Westminster was immediately prevented from receiving information.

The party added that only one member of each MPs office should be on internal mailing lists at any given time to prevent confidential information being leaked.

Many former MPs’ staff move into lobbying roles upon exiting parliament. These jobs frequently involve contacting parliamentarians — often the ones who formerly employed them — on behalf of commercial clients.

This year hundreds of aides left parliament largely because of the July general election, when 175 Conservative MPs lost their seats.

A House of Commons spokesperson said: “Network accounts sponsored by MPs are audited throughout the course of every Parliament, with accounts closed and access to the parliamentary estate removed, as soon as we are told to by either the sponsoring MP or by IPSA.”

They added: “Individual MPs, as the sponsors of their staff and owners of the data, are required to inform us of any changes or closures.

An IPSA spokesperson said: “Parliamentary accounts are administered by Parliamentary Digital Service, and IPSA sends data on a weekly basis confirming any members of staff whose leaving date has passed.”