The Cabinet Office was entitled to neither confirm nor deny whether two 1960s intelligence files it has retained from The National Archives contain terms including "GCHQ", "SIGINT" and "Menwith Hill", the Information Commissioner has ruled in a decision notice upholding the department's reliance on section 23(5) of the Freedom of Information Act 2000.
The request, made on 14 May 2025, concerned three records listed on The National Archives catalogue as retained by the Cabinet Office under section 3(4) of the Public Records Act 1958: CAB 163/123, described as "Telecommunication equipment: implications for the Intelligence Service of the Post Office's loss of its monopoly"; CAB 301/419, "Future of Signals Intelligence (SIGINT)"; and CAB 163/76, a review of interception procedures following the change in status of the Post Office. All three date from 1967 to 1969.
The complainant asked for index or content lists for each file and then, in two further parts, whether CAB 163/123 contained any of eleven listed terms, among them "Government Communications Headquarters", "GCHQ", "SIGINT", "earth station", "INTELSAT", "Bude", "Menwith Hill" and "Goonhilly", and whether CAB 301/419 contained terms including "Post Office Bill", "specific direction(s)", "interests of national security" and "satellite".
The Cabinet Office responded on 12 June 2025 that it held no index or content lists and relied on section 23(5) to neither confirm nor deny whether either file contained any of the specified terms. The complainant sought an internal review on 15 June 2025 and, when none was forthcoming, complained to the Commissioner. The department eventually upheld its position on 24 September 2025.
Section 23(5) removes the duty to confirm or deny whether information is held where compliance would itself involve the disclosure of information supplied by, or relating to, any of the security bodies listed in section 23(3). It is a class-based exemption requiring no demonstration of prejudice and is not subject to the public interest test. The Commissioner reiterated that he need not determine whether the information is actually held, that it is sufficient for either a hypothetical confirmation or a hypothetical denial to disclose section 23 information, and that "relates to" is read widely, though the connection to a security body cannot be so remote that the exemption is not engaged.
The complainant argued that the department had read section 23 too broadly, that given the files' descriptions and the passage of time at least some of their contents were likely to have come from bodies outside section 23(3), and that his request simply sought to establish whether certain words appeared. He said the Cabinet Office should have disaggregated the terms and answered for those falling outside the exemption.
The Cabinet Office said it was applying section 23(5) to the request itself rather than to any identified information, that confirmation following a keyword search would reveal material relating to or supplied by one or more section 23(3) bodies, and that the express reference to GCHQ meant confirmation would identify at least that agency. No ministerial certificate under section 23(2) had been issued.
The Commissioner accepted that terms such as "Post Office", "Post Office Bill" or "satellite" could in isolation appear in contexts with no security-body connection. But the request was not a general one for documents containing those words: it asked whether they appeared within two specific retained files, one expressly about the implications for the Intelligence Service of the Post Office losing its monopoly and the other expressly about the future of signals intelligence.
Read as a whole, the request was directed at the presence or absence of intelligence, communications, interception or national security material in those files, and either answer would reveal something about that. Confirmation or denial "would not be neutral", the Commissioner found, and section 23(5) was engaged.
On disaggregation, the Commissioner drew a distinction between section 23(1), where an authority has identified information and may need to consider separating out non-security-body material, and section 23(5), where the question is only whether confirming or denying would itself disclose section 23 information. Answering for some terms while maintaining NCND for others would reveal which terms had the closer security-body connection, and requiring the department to split the list would undermine the purpose of the provision.
The age of the records, created more than 55 years ago, did not in itself prevent section 23(5) from applying. As the exemption is absolute, the Commissioner did not consider the public interest.
The notice records that FOIA sets no statutory deadline for internal reviews but that ICO guidance expects them to be completed within 20 working days, or 40 in exceptional circumstances, and that the Cabinet Office only completed this one after the complaint to the ICO had been made. The Commissioner did not order any steps.
The decision notice, IC-424475-Y3F2, is available on the ICO website: https://ico.org.uk/action-weve-taken/decision-notices/2026/09/ic-424475-y3f2/
