Inside the Legal Aid Agency cyber hack

0:05Hi, I'm Charlie Duffield and welcome back to The Standard Podcast. If you're new here, hit follow and give us a rating. For the latest news, head to standard.co.uk. Coming up later in the show. I know it's only a Monday, but if you're up for a pint, stick around.

0:29But first, there's been a major hack of the UK's justice system by cybercriminals. They've seized a significant amount of personal data from people who have applied online to the legal aid agency over the last 15 years The hackers downloaded personal details, criminal records, national insurance numbers and financial details from those who have claimed legal aid since 2010 Investigators from the National Crime Agency and National Cyber Security Centre are probing the attack and the government has now issued a public safety warning. Speaking from London's Old Bailey, we're joined by the London Standards Court's correspondent Tristan Kirk.

1:16Tristan, could you explain what the Legal Aid Agency actually is? So the Legal Aid Agency is the body which deals with anyone's application for legal aid, as the name suggests. In the criminal courts, the civil courts, in the family courts, any kind of legal proceedings, some people are entitled to apply for legal aid, and that's when they are not able to pay for their own legal representation, and then the government provides that legal representation for them. It's a body that's set up to ensure that anybody who goes through the justice process is given a fair run of things. So people who don't have any money at all and are accused of a crime will at the very least have a lawyer to represent them and to put forward their case by somebody who understands the legal system.

2:09And can you talk us through the criminal action here? Towards the end of April, the news emerged for the first time that the legal aid agency has been the victim of a cyber attack. Now, at that stage, they thought that it was limited to the law firms and the lawyers and the legal aid providers who use the system day to day, basically to submit put forward claims for legal aid, which they are claiming on behalf of their clients. It was an attack on the system. And it was said that some of the data contained within that system had been taken, which is obviously quite sensitive data, people's names, addresses, potentially their bank details, national insurance numbers, things like that.

2:55Now, today, the government, the Ministry of Justice have said that actually the cyber attack was far greater than it was first realised. It wasn't just the lawyers who were affected, but actually the clients, the individuals who were seeking legal aid and seeking legal representation. This is potentially hundreds of thousands of people, if not millions of people, who have used the legal aid system from 2010 until this year. So there's 300 ,000 odd legal aid claims made every year. That is potentially a huge number of people who may have been affected. What has the legal aid agency said in response?

3:37Well, the legal aid agency said it's working with investigators, it's working with specialist people in deal with cybercrime. And today they've taken the step of disabling their online platform, which was the victim of the attack and which is presumably the vulnerability that they have identified. Now, in recent years, the system has moved from what used to be a paper-based system. It will fill out forms and handing them over in order to obtain legal aid. And the creation, instead of an online portal, which is obviously what we're all used to in the modern world, whereby all of these claims would go into the system electronically, details submitted in a process that people would assume naturally is confidential.

4:27And so you're putting forward very sensitive details, bank account details, financial information, as you're trying to justify claiming legal aid, names, addresses, etc. There's a lot of material that they've been handling, and now that they've identified that there's been what sounds like a fairly wide-scale breach of that system, they have decided to temporarily disable the system, which is obviously going to have some serious ramifications. How can this sort of thing be prevented then? What should happen is that the people in positions of power in the government, the Ministry of Justice, the legal aid agency should look and say, have we got a system here that's fit for purpose?

5:12Now, the Law Society, which is the body that represents lawyers across England and Wales, has said straight away that this is very, very concerning news, a massive cyber attack on the system. But what it should do is show to people that we have an antiquated system, which is fragile and is not really fit for use in the 21st century. it's it's unfortunately sadly a theme of of systems that are in place across justice that they are old they are creaking they are not what you would expect of you know a justice system operating in 2025 but that's what we've got because there's been a consistent underfunding of the the justice sector for many many years this is this is not some new development and so the The first thing I think that needs to happen is that there needs to be an urgent upgrade of the computer systems that are used, because the people that are using them are relying on them to be secure.

6:15For individuals, the Ministry of Justice are saying to anybody who's claimed legal aid in the last 15 years, that you now have to be on your guard about potential cyber attacks aimed at you, phishing, scams that come on your phone, emails, in writing, anything that could be the hackers using that information that they may have obtained to try to get money out of you, you have to be watching out from that. And that's really why this is such a serious incident, is it's not just a case of hackers have accessed the system. They've accessed the system, have downloaded a lot of data. They say over 2 million pieces of data.

7:01The real number, not quite clear yet. And that data can then be sold on, distributed, and utilised, weaponised against the people who are involved. And so it really should be a wake-up call for everyone in the justice service that we need better systems, but also for the people who've been involved, they now have to be on their guard as well. And finally, have you seen anything else like this before in your career? I've seen quite a lot of this kind of crime over my career in the courts. It was a while ago now, but there was groups who would carry out DDoS attacks on various systems. That was politically motivated, anarchic in nature, basically attacks by hacking groups on major organisations, essentially for the sake of doing the attack to prove that they could to bring chaos to the system.

7:57We've obviously heard in recent times of various different cyber attacks on organizations, recently marked suspensors, obviously, legal aid agencies. And I think that they are increasingly being used by nefarious groups for illegal purposes, for accessing people's private data and using it against them for hacking, for extortion, phishing, all these kinds of things that can be done, the scams that we all know about. Well, this is the genesis of a lot of those scams is the accessing of the data. I've also come across the occasional case where somebody has used their skills with computers and technology to weaponize hacking against organizations that they've got a grudge against, a case I covered where a guy had fallen out with his school that he used to attend and took against various retail organizations.

8:55So there are various different reasons why people do these kinds of things, but they're all tied together by the fact that there really is a need for a lot of vigilance around online security because so much data is placed into the online communities these days that there just has to be that constant vigilance around areas that people might target for whatever reason they are targeting. Let's go to a break. Coming up in part two, there's cash being splashed on a new microbrewery in the centre of the capital. We'll see you back here in just a moment.

9:46Welcome back. For over 250 years, the black stuff has been captivating drinkers around the world. I'm talking about Guinness with its whitehead and distinctive harp logo. Now, Diageo, the company which owns the iconic Irish stout, is bringing back brewing to London's Covent Garden after more than a century, with the opening of a huge beer-making cultural hub before the end of the year. Joining us is the London Standard's business editor, Jonathan Prynne. Jonathan, tell me more about this new brewery. It's been on the cards for quite a while, hasn't it? It was first announced in 2022 with an open date scheduled for 2023.

10:31Unfortunately, they've hit a number of snags, as is often the case with large scale projects, particularly one of their contractors went down last year. So they're now hoping to get it open and up and running in time for Christmas. That's certainly their latest timeline anyway. The Guinness brand in itself has been growing in popularity. Is that right? It has. Young people are sort of shifting to Guinness and huge numbers in particular. and you'll recall that before Christmas last year there was actually a sort of Guinness drought. Literally they couldn't supply enough Guinness out of their brewery in Dublin to keep the UK supplied so there were real shortages for a few weeks.

11:12And for those who aren't partial to a pint, what else will this site offer? It's a huge site, 50 ,000 square feet so they've got this microbrewery and I should stress actually, although it is very much Guinness's project, The drink Guinness will not be brewed on site. That will continue to be brewed in Dublin at their brewery. They are talking about between 12 and 14 other beers being brewed there, all sorts of things ranging from IPAs to bitters to lagers. There'll be a non-alcohol or low-alcohol alternative as well. So it'll be quite an interesting and active brewery on a site where brewing has been taking place for 300 years or so, but not for quite a while.

11:57And they're bringing it back to life. But as well as the brewery, there'll also be a couple of restaurants, a bar, a shop, focusing on Guinness-themed merchandise, including some kind of rare and limited edition type ranges. And there's going to be a sort of training academy there as well for brewers. So it's going to be really quite a large complex, really, in the heart of Covent Garden. They have big ambitions for it. They're hoping for half a million visitors a year, which would make it a very, very substantial attraction. You touched on it earlier, but the location itself is really historic.

12:32What used to happen here? Yeah, no, it's got a fascinating history. Old Brewer's Yard Brewing started there in the early 18th century, continued for a long, long time. Different companies brewing beers there. And they finally stopped brewing there in the early part of the 20th century, 1905, I think it was. So there's been no brewing on this site for 120 years. So it's really quite exciting that brewing is coming back to Covent Garden after more than a century's break. They're doing tours as well. As microbreweries go, it's quite a big one. So I think it'll be really interesting to see how they get on.

13:16And that's The Standard. For all the latest news, head to standard.co.uk and please do drop us a line at podcasts at standard.co.uk. This podcast returns tomorrow at 4pm. We'll see you then.