Malicious emails received over the last three years (FOI2536)

We received your request on 8 July 2025.

We have handled your request under the Freedom of Information Act (FOIA) 2000.

A copy of your request is set out in the extract below:

I’d like to know the following under the Freedom of Information (FOI) Act.

Number of malicious emails blocked by your organisation over the last three calendar years.

Please also categorise the emails e.g.:

• Spam: 45,000
• Phishing: 3,400
• Malware: 4.7000

I confirm that Ordnance Survey only holds a record of blocked emails for a period of 90 days, therefore, we do not hold the information you have requested, other than for the last 90 days.

However, we are unable to comply with your request and provide the figures for the last 90 days; as we consider the information you have requested to be exempt from disclosure under section 31(1)(a) of the FOIA, as explained below.

Section 31(1)(a) the prevention or detection of crime

Section 31(1)(a) exempts information if its disclosure would or would be likely to prejudice the prevention and detection of crime. In this case, we consider that disclosure of the information would be likely to make OS more vulnerable to crime, namely a malicious attack on our security and computer systems.

Disclosure of the information would compromise the measures in place to protect our security and computer systems, leaving us vulnerable to attack. The information would be likely to assist someone in determining the level of effectiveness of the security measures in place in detecting and defending against such attacks, and would be likely to assist a determined attacker by allowing them to evaluate any weaknesses and vulnerabilities which may, or may not, exist. We consider that disclosure of this type of insight into our computer and security systems would create a real and significant risk to those systems and make OS more vulnerable to crime.

This is a qualified exemption, and we are required to consider the public interest.

Public Interest Test

OS recognises the need for transparency; and that there is a public interest in knowing that OS has measures in place to prevent such attacks and protect information; however, disclosure of this information would mean our computer and security systems would be more vulnerable to malicious attacks, therefore facilitating the possibility of crime.

Section 31(1)(a) is a prejudice-based exemption, and there is a public interest inherent in avoiding the harm specified. OS considers that the prejudice would be likely to occur. We are not aware of a significant wider public interest in the information requested and we are satisfied there is a greater public interest in protecting our computer and security systems, by withholding the information under this exemption.