It is not in the interests of the UK’s national security for departments to confirm whether they hold information about attacks against their IT systems. This would enable individuals to deduce how successful the UK is in detecting these attacks and so assist such persons in testing the effectiveness of the UK’s IT defences. This is not in the public interest.