Legal Aid Agency cyber security incident: frequently asked questions

Client data breach

Who might have been impacted by this breach? 

We believe the group has accessed and downloaded a significant amount of personal data from those who applied for legal aid through our digital service since 2010.

This data may have included contact details and addresses of applicants, their dates of birth, national ID numbers, criminal history, employment status and financial data such as contribution amounts, debts and payments.

What provider information has been breached?

We communicated to legal aid providers on 30 April that we believe that some financial details of providers may have been exposed including bank account numbers and sort codes. We have recommended providers remain vigilant for any unusual activity on their accounts.

What steps should I take to protect myself? 

We would recommend anyone who believes they could be involved in this data breach to take steps to protect themselves. This includes being alert for any suspicious activity, messages or phone calls and taking steps to update passwords. If in doubt about anyone you are communicating with online or over the phone, to verify their identity independently before engaging further with them. The National Cyber Security Centre’s webpage contains information on how to protect yourself from the impact of a data breach. The webpage can be found at https://www.ncsc.gov.uk/guidance/data-breaches.  

Are provider IT systems at risk?

There is no direct risk. There is no direct connection from LAA systems to any provider system – it is a one-way provider to LAA connection only.

Do legal aid providers need to contact clients?

There is no contractual obligation on providers to report this incident to the ICO or to inform clients. The data impacted by this incident is either owned by the LAA or is considered Shared Data within the definition of the contract. The contract at clause 16.3 of the standard terms sets out that the responsibilities of the data controller will be exercised by the party in possession of the data – in this case by MoJ as the data controller for LAA. MoJ has notified the ICO of the incident, and has notified data subjects through the public announcement on GOV.UK on 19 May. 

Legal aid operations and communications

Can I include a claim in my Crime Lower monthly submission for a case that has completed but where no Representation Order has been granted yet due to the Portal outage?  

Yes. If your application relates to a Summary Only / Either Way matter in the Magistrates’ court, please assume that the application will be granted. 

When our internal systems become available again, you will need to submit these applications. 

When assessing your application, if we determine that the case should not have been granted, the caseworker will authorise legal aid from the date of the initial stamp (which you will confirm to us) until the date your application is reviewed. At that point, a withdrawal of legal aid would occur. This process will enable you to claim for any costs incurred during this period.  

We understand that you will not have a Representation Order, a note on the file referring to the incident will be sufficient for audit purposes.  

As you will not have received a MAAT number for these cases, please use 900900 as a dummy MAAT number when claiming.  This is essential to ensure that it is clear that your claim is a contingency claim, and allows us to track and monitor these.

What should providers be capturing when using their delegated function? 

Providers when using delegated functions should capture all the information they would normally, including undertaking the client’s financial assessment and capturing any required evidence of the client financial circumstances. 

What signed declarations are providers expected to obtain and to retain on file when using delegated functions while the portal is down?  

The following applies in relation to grants of emergency representation via Delegated Functions made during the contingency process: 

• A client signature is not required for the provider to grant emergency representation, which can be in place for up to eight weeks.
• The LAA will not retrospectively challenge this grant for the lack of a signature if there is clear evidence (for example, email exchanges or telephone attendance notes etc) on the file that the grant was legitimately made in accordance with the client wishes.  The evidence needs to demonstrate one of the following: (i) The client formed the appropriate intention to sign and submit the application form, or (ii) You have been directly appointed by a court or tribunal to act for the client.
• At the point that an application can, be submitted onto CCMS, you should seek a signature from you client at the earliest possible opportunity.
• You may still submit a claim if you are unable to secure a client signature, including a digital signature, where: (i) it is clear reasonable attempts have been made to secure the client’s signature, and you have provided evidence of the client’s intention to sign the form, or (ii) you have been appointed to act for a client by a court or tribunal.

When can providers use delegated functions?   

Providers can use delegated functions for initial applications. The time limit of an emergency certificate is 8 weeks; the provider can continue to amend the scope and costs of their emergency grant for the 8 weeks, or until they submit the application on CCMS for the LAA determination. A table of Delegated Authorities Procedural Regulations which details what providers can delegate for, subject to the terms of the relevant contact, can be found here. 

When the LAA make the substantive determination, providers are unable to use delegated functions to amend the scope or costs of a certificate. Providers are able to submit the amendment for a decision at a later date, the LAA will exercise the backdating provisions were required.   

Will BACS statements continue to be sent following each payment run? 

BACS statements will continue to be printed and posted out as usual after each payment, as will the Provider Statement of Account (PSOA) that are sent out at the end of each month.

How do I make a claim for Crime Hardship payments?

Providers are referred to the Crown Court Fee Guidance and Litigator fee claim forms and guidance - GOV.UK for details of hardship and interim claims.

Graduated fee (LGFS and AGFS) claim assessment has now recommenced and payments have begun this week (w/c 2 June) however, any claims for hardship may be discussed with your Contract Manager.

What should providers do if a civil application, amendment or appeal was submitted via the portal previously, but no decision was made before the portal went down? 

Regardless of whether a case was previously submitted on the system, providers should follow the same procedures under the contingency process. 

How should providers apply for amendments to cost and scope in civil certificates when the portal is down?  

Providers are able to submit the amendment for a decision at a later date, the LAA will exercise the backdating provisions were required. 

If the provider wants the LAA to make the decision, if they are unsure if the merits criteria is being met they should contact the LAA CST team to explain the urgency to obtain a contingency reference number. They will then be advised to submit the relevant application form and email it to ContactCivil@Justice.gov.uk where they will receive a decision by return email. Providers in these circumstances should try and provide a copy of their most recent certificate, any reports or evidence to support coverage to Final hearing.

What happens if a provider uses delegated functions then the LAA at the point of consideration deem the merits are not met?  

The LAA will honour all uses of delegated functions which are made under the terms of the providers contact and the regulations, if it is deemed the merits are not met at point of LAA assessing an embargo and/or discharge of the emergency certificate will take place from that date, providers can bill for work up to that date. It is important that the provider ensures that a reasonable assessment of the client’s financial circumstance (including that the client has disclosed all financial information) to ensure the client is not at risk of the certificate being revoked and having to pay back the costs of work undertaken.  

How do providers record an application after the use of delegated functions?  

Providers should keep a record of any cases granted under delegated functions. There is no need for these to be sent on paper-based forms via the contingency process. Funding granted under delegated functions should be sent via the Portal once access has been restored.  

What Application and Means forms should be submitted for a substantive application?   

After you have contacted the LAA Customer Service Team and received a contingency reference number for urgent work you will be advised to download, complete and email the relevant Application and Means form from GOV.UK with any supporting documents to ContactCivil@Justice.gov.uk   

• CIV APP1: application for civil legal aid certificates
• CIVAPP3 – application for legal aid in family proceedings
• CIV MEANS 1: financial assessment form, not passported
• CIV Means 1A: self-employed sole trader
• CIV MEANS 1B: trading in a self-employed partnership
• CIV MEANS 1C: company director or a shareholder in a limited company
• CIV MEANS 2: Financial assessment form for legal aid client passported
• CIV MEANS2A: passported, self employed or in business partnership
• CIV MEANS 3: client living outside the UK

Will a provider need to re-enter a paper application submitted under a contingency reference number onto CCMS when the portal access has been restored?  

No, any decisions made by the LAA on paper applications during contingency arrangements will be entered by the LAA onto CCMS once system access has been restored.  

Has the LAA extended the length of the emergency certificates?   

Emergency representation currently remains limited to eight weeks.  

What will happen when a client’s means is eventually assessed, and a contribution is due?  

Contributions will become effective from the date the LAA makes a substantive determination. They will not accrue arrears.  

How should providers deal with the need to increase a cost limit of a certificate?  

Requests to increase costs are applied retrospectively and are not date specific. The LAA would encourage providers to apply for cost limit increases when access to the portal has been restored. The LAA accept there is an element of risk with this for the provider and will provide a contingency reference where the provider is not prepared to work at risk.  

How will High Cost Family case plans be considered under contingency? 

To register a High Cost Family query providers should email Highcostfamily@justice.gov.uk with supporting evidence. The High Cost Family team will not currently accept case plans on a contingency basis. Once the system is back up the team will consider and approve costs, if appropriate. Providers may submit an extension request if they are seeking reassurance that their case plan will be dealt with when CCMS is back online.

How should I bill Legal Help escape cases?  

Providers should continue to submit escape fee claims via Galaxkey and email. These will continue to be processed by LAA for payment under the normal timeline. Providers can continue to submit escape fee claims if they have not been uploaded onto CWA due to the portal outage.   

How will I know the value of Escape Case assessments?  

Providers will continue to receive the usual individual assessment letters, which will confirm the assessment outcome. If the result is “paid as claimed” then providers will receive the full amount claimed for the case. For those claims that have been reduced but still require an Escape Case payment (ie, they have not been reduced to a Fixed Fee only) then the assessment table included within the assessment letter will detail what has been authorised against what has been claimed. 

How should I account for Escape Cases in my Legal Help / Crime Lower monthly submission? 

Guidance is provided in the monthly submission form available for download at LAA Contingency Monthly Contract Submission on what to include in your total claim figure. The totals reported for your monthly submission must not include any adjustment for Escape Cases regardless of whether they have been submitted for assessment. Escape Cases will be processed as usual and the LAA will make an adjustment to the monthly payment to account for any additional sums due for Escape Cases that have been assessed during the month.

Are there any issues with Qualified Legal Representative (QLR) claims? 

No, the Qualified Legal Representative scheme is unaffected and claims can be submitted as normal. 

How can I progress ECF controlled work applications?  

You can continue to submit ECF controlled work applications in the usual way. For urgent cases, please contact us on ContactECC@justice.gov.uk. In circumstances where you would ordinarily use CCMS, please submit an urgent application using the appropriate application forms and submit to this email address. Guidance on the forms to use is available at this link: Legal aid: apply for exceptional case funding

How can I make claims for Payments on Account (POAs) and final claims? 

Due to the current portal outage, the LAA is unable to process claims for payment, including POAs in the usual way. The Average Payments for Civil Representation contingency scheme has been calculated to include any POA payments or interim/final bill payments that a provider or member of the independent Bar would otherwise has received.  

More information on how the scheme, including how it is calculated, and what to do if you do not believe it is appropriate for you, is available here: Contingency Payment - Providers Guide 

Where we have a new client and urgent work needs to be carried out and we need to decide whether to apply for an Emergency/ Substantial application, what do we do?  

Under Current contingency arrangements, if the provider has a new client and there is urgent work they should exercise Delegated Functions if reasonable to do so and start the work required, this application should be uploaded through CCMS when access is restored to the portal. We are waiving the need for providers to submit the application to us within 5 working days. 

If providers are unable to exercise Delegated Functions the provider should contact the LAA CST team to explain the urgency and why they cannot use delegated functions to obtain a contingency reference number, they will then be advised to submit the relevant application form and email it to ContactCivil@Justice.gov.uk quoting the contingency reference number, where they will receive a decision by return email.  

Where a client has a Final Hearing and we are unable to amend their certificate to include the Final Hearing scope, will this be honoured and the Final Hearing be covered later?    

Providers are able to submit the amendment for a decision at a later date and we’ll exercise the backdating provisions. 

If the provider wants the LAA to make the decision, if they are unsure of the merits criteria is being met they should contact the LAA CST team to explain the urgency to obtain a contingency reference number, they will then be advised to submit the relevant application form and email it to ContactCivil@Justice.gov.uk where they will receive a decision by return email. Providers in these circumstances should try and provide a copy of their most recent certificate, any reports or evidence to support coverage to Final hearing.   

Why is the Portal offline? 

A message updating providers on the position was sent on Monday, 19 May. Following the planned weekend outage last week the decision was taken to keep the Portal offline at this time. Providers will receive a further update on access to the system on Thursday 22 May. 

Why did two payments appear in my account w/c 19 May?

Following the extended downtime of the LAA Portal on 8 and 9 May, the LAA worked hard to process as much of the backlog as possible to ensure providers received the payments they are due. To do this it is was necessary to undertake two payment runs.

What bills will be paid in the payment run for on 27 May?

Civil Representation and Crown Court Bills authorised up to Friday, 16 May.

Are Central Fund claims impacted? 

The central funds claimed assessed and administered by the LAA are not impacted.  Please submit as usual.   

Is Secure File Exchange via Galaxkey still operational? 

Yes, the Secure File Exchange, via Galaxkey is operating as normal.

I did not receive the email notification, why not?  

All providers and barristers registered on the portal were sent the message. Please check whether your spam filters have blocked incoming emails from the LAA. You will need to ensure you are able to receive messages from communicationsdepartment@justice.gov.uk and legalaidbulletin@labulletin.org.uk to ensure that you receive future correspondence. Alternatively, please speak to your LAA Contract Manager in the first instance if you think you are not receiving LAA emails to ensure that your correct details are on file. 

Can I correspond with the LAA by email? 

Yes, there is no concern with email communication.

Will the LAA provide a set of communications for legal aid practitioners that they can give to clients if they are contacted?

Guidance for clients and providers is available at Legal Aid Agency cyber-security incident - GOV.UK.

We have recently received a payment run from the LAA for criminal legal aid fees, but the reconciliation notification did not come through afterwards. What is the latest update on that situation?

There has been a one day delay in posting remittance advice for the payment run on Tuesday 27 May, but otherwise they will be arriving by DX or Royal Mail as usual. If a provider still has a query about a payment they have received they can contact paymentinformation@justice.gov.uk who will be able to provide remittance advice. 

Should providers continue to submit claims for Advocates Graduated Fee Scheme claims in criminal defence Crown Court cases, which uses a different portal?

CCCD remains available, please do continue to submit claims there. The LAA will be able to process these when internal systems are available.

How does the current incident impact on HLPAS payments?

HLPAS payments will be paid as normal. Claims made as part of the CWA contingency submission by 20 June will be paid on or before Monday 7 July.

Claims made on spreadsheet can continue to be submitted in the usual manner. Your payment will be picked up on the next payment run after receipt and processing which may result in you receiving your payment earlier than you currently do.

Should clients continue to make contributions?

Contributions for existing certificates will continue as normal, however, it would be appreciated if clients could be advised to take particular care to provide valid payment references such as Case ref, CCMS account number or invoice number.