Export & Compliance

MGH Defence sells into a market in which enthusiasm is cheap and paper is decisive. For that reason, export control, personnel vetting and audit discipline are treated here as production activities rather than ornamental legalities. A discussion that cannot survive scrutiny by the licensing authorities, the customer's ministry and our board is treated as business that never existed.

Export licensing and government consultation

Controlled programmes, including KESTREL-3 and selected software builds supplied with sovereign interfaces, are handled only through the United Kingdom export licensing process. Applications are prepared through SPIRE, ordinarily for a SIEL, and are lodged only when the consignee, the receiving unit, the intended end use and the onward-support arrangements can all be stated without embroidery. We do not circulate performance annexes in anticipation of an application; those papers follow the application, not the reverse.

Where the destination, operational context or declared user raises wider policy questions, consultation is undertaken with the FCO before any substantive release beyond open marketing text. End-user undertakings are required in signed original form and must name the recipient authority, the equipment concerned, the operating location where known, and the prohibition on re-transfer, re-export or technical disclosure without prior written consent. If the undertaking is vague, photocopied beyond recognition or signed by someone whose enthusiasm exceeds their authority, we decline politely and keep the file shut.

Compliance calendar

Ethics and Oversight Committee

Board oversight exists for sensitive opportunities, data handling, export control and proposed end use. Names, meeting schedules, decision records and external participants are not available publicly.

Responsible data practice

Our data platforms are marketed on the footing that traceability is more useful than mystique. MERIDIAN records the warrant, task or authority against which a search was run, while LATTICEWORK publishes a confidence score and reason string for every asserted match. That design is not a public-relations flourish. It permits a customer to inspect why two records were joined, to unpick a merge that should not stand, and to show an auditor that an analyst did not simply "know" because a machine looked certain. Bulk ingest is accepted only where the customer confirms the lawful basis for holding the source data and the retention policy under which it is being supplied.

Personnel and information security

All permanent staff are required to complete BPSS screening before start. Appointment to project teams handling customer information ordinarily requires SC, and a smaller number of posts at [] require DV. Visitors are badged to escort status unless their clearance has been verified in advance, and removable media are issued only against a named business need.

• OFFICIAL-SENSITIVE material may be processed on accredited division systems, subject to role-based access and audit logging.
• SECRET work is handled at [] only, within the segregated facility approved for that purpose.
• Technical data are released externally by controlled register, not by convenience, and never merely because a meeting went well.

Raising a concern

Concerns about export control, data handling, classification, gifts, intermediaries or proposed end use may be raised through line management, the Company Secretary, or directly with the committee secretariat. Written concerns may be sent by e-mail to dataprotection@mgh.org.uk. Reports may be made in confidence; reprisals are prohibited.

Page last updated 18 February 2003. Prepared by the Board Compliance Secretariat. Ref. MGH/DS/COMP-203. Best viewed at 800 × 600 in Internet Explorer 5 .