Uber London Limited
Aldgate Tower
First floor, 2 Leman Street
LondonE1 8FA

Transport for London
London Taxi and Private Hire
5 Endeavour Square
Stratford
LondonE20 1JN
wwwtfl.gov.uk

25 November 2019
Dear Mr Heywood and Ms Roylett,Application for the renewal of a Private Hire Vehicle Operator’s Licence
We write further to Uber London Limited’s (ULL) application for the renewal of a
London Private Hire Vehicle (PHV) Operator’s Licence, which we received on 8
November 2019.
We have carefully considered ULL’s application, together with the results of theenquiries that have been undertaken over the past two months and otherrelevant material available to us.
For the reasons set out below, TfL is not satisfied that ULL is a fit and proper
person to hold a licence. As such, TfL has decided not to grant ULL a PHV
operator’s licence to extend beyond 25 November 2019.

In summary, the reasons for our decision are as follows.
a) TfL recognises that ULL has made a significant number of positivechanges and improvements to its culture, leadership and systems
in the period since the Chief Magistrate granted ULL a licence inJune 2018. In particular, ULL now corresponds with TfL in atransparent and productive manner and has built up positive
relationships with the Metropolitan Police (amongst other bodies).
ULL has passed its compliance inspections and it has adopted
Programme ZERO: a programme designed to drive incidents of
ULL’s regulatory non-compliance down to zero. All the positive
matters set out above have been carefully considered and taken
into account in this decision.

Page 2 of 62b) However, in the period since June 2018, ULL has reported anumber of regulatory breaches to TfL. Some, indeed many, of
those breaches have been extremely serious in nature. By way of
example:i.

Some of those breaches have concerned cases in which
drivers were providing PHV services without hire and reward
insurance in place. Some of those cases led to ULL pleading
guilty to the criminal charge of causing or permitting drivers touse vehicles on a public road for hire and reward without therequisite motor vehicle insurance policy. This is a particularly
serious public safety issue. The risks to the public of uninsured
drivers, offering uninsured services, are grave and acute.

ii.

Some of those breaches have concerned cases in which
individuals were providing PHV services, via the Uber app,using another driver’s login. Put simply, the individual in the car
was not who they should have been. Once again, this raises
important safety concerns because all of the drivers involved
have engaged in fraudulent activity and therefore would not be
considered fit and proper to hold a private hire driver licence inLondon. ULL has identified most of those individuals following
several audits. Of those, a number had been suspended or
dismissed by ULL and one had previously been licensed as a
PHV driver, but had their licence revoked. In one case, it has
not been possible to identify who was driving the car at therelevant time. For obvious reasons, once again, this raises
substantial public safety concerns: the services might havebeen provided by an individual with a serious criminal record ora medical issue and/or whose DVLA driving licence, or PHV
driving licence has been revoked. The risks arising to the
public are serious and substantial.

c) These breaches have derived, at least in part, from changes to the
Uber systems and the Uber driver app, which have then been
exploited by drivers. Others are the consequence of human error.
ULL has taken a number of steps to address these breaches andthe number of those incidents is currently falling. This progress has
been taken into account.
d) However, these breaches raised serious doubts as to whether TfL
could have sufficient confidence in ULL’s ability to prevent
breaches of this kind – and indeed wholly new breaches that havenever occurred previously – recurring. In particular, the breaches
raised concerns as to ULL’s systems and processes because, atPage 3 of 62

least in part, they have derived from changes or modifications to
ULL’s systems that have left them vulnerable to exploitation.
e) ULL’s biannual Assurance Reports have provided some assistancein assessing ULL’s ability to prevent similar breaches arising in
future. Although these reports are improving, TfL has – in certain
respects - found them less useful than they might have been. In
the recent past, at least, those reports have failed to recognise theimportance of some of the breaches that have occurred and therisks that flow from them, from the point of view of both passengers
and TfL. The assurance reports alone were not sufficient to provide
the necessary confidence in ULL’s systems.
f) As a result of its lack of confidence in ULL’s ability to prevent newincidents of this kind occurring, TfL commissioned two reports by
Cognizant. TfL commissioned those reports in order to understandwhether ULL’s processes, change management and cyber security
were at or above industry standard, for a company in ULL’s
position, which would have provided reassurance as to ULL’s
fitness and propriety to hold a PHV operator’s licence.
g) Cognizant’s report into ULL’s cyber security systems concluded
that they were at or above the standard that Cognizant would
expect, although it identified some weaknesses. This provides asignificant degree of comfort in that area.
h) However, the Cognizant report into ULL’s IT Service Management
rated ULL as below the standard that would be expected of acompany in its position, in certain important respects. ULL
responded to that report by way of a letter and at a meeting with
Cognizant and TfL, suggesting why they considered the report
was: (i) factually flawed and (ii) not an appropriate means by whichto assess ULL’s systems in any event. Cognizant has responded to
ULL’s comments and stated that they have not caused it to change
its views.
i) As a consequence, the Cognizant reports did not provide sufficientconfidence in ULL’s systems and processes and, in particular, thatthose systems and processes are currently sufficiently robust toensure that the kinds of serious breaches described above will notrecur.
Full reasons for our decision not to grant ULL a PHV operator’s licence are set
out below:

Page 4 of 62‘Fit and proper person’: s. 3 of the Private Hire Vehicles (London) Act 1998(“the 1998 Act”)
1. Section 3(3) of the 1998 Act sets out the requirements that must be
satisfied before TfL, as licensing authority, can (and must) grant alicence. These include the requirement that the applicant is a “fit andproper person” and such further requirements as TfL may prescribe. The
phrase “fit and proper” is used in a number of statutory contexts, but its
meaning is context-specific: a person who may be “fit and proper” for the
purposes of one licensing regime may not be for the purposes ofanother. The Courts have confirmed that licensing authorities may take
into account “anything which a reasonable and fair-minded decision
maker, acting in good faith and with proper regard to the interests both ofthe public and the applicant, could properly think it right to rely on.”Approach to the decision
2. The relevant material has been summarised in the following order:a) Those matters which suggest that ULL is now fit and proper to hold a
PHV operator’s licence. The factors that could be capable ofsupporting a conclusion that ULL is a fit and proper person have been
carefully considered and taken into account in our decision.
b) Those matters that have led to the decision that ULL is not currently a
fit and proper person to hold a PHV operator’s licence. This includes
the material that has become available to TfL in the period since thegrant of the 2-month licence in September 2019.
POSITIVE FACTORS THAT SUPPORT ULL’S APPLICATION(a) Transparency and communication with TfL
3. Since June 2018, ULL has written to TfL about a number of mattersconcerning its operations, in compliance with conditions 5, 7, 8, 11 and
12 imposed by the Chief Magistrate following the hearing in 2018. Over
this period, TfL has also written to ULL and raised several issues thathave come to its attention via the press, from passenger complaints, or
third party representations. TfL has met with ULL approximately every
quarter since June 2018 to discuss ULL’s operations and various
compliance issues that have arisen. Where appropriate, TfL has also met
with ULL on an ad-hoc basis to discuss specific issues and concerns andto seek ULL’s comments.
4. TfL has not set out the full extent of all of its correspondence with ULL inthis letter and, nor is it necessary to do so in order to set out the reasonsfor the decision. However, all of the relevant material has been reviewed

Page 5 of 62

in making the decision. This includes considering ULL’s application of 8
November 2019, its application of 3 July 2019, together with a covering
letter and correspondence from Ms Laurel Powers-Freeling in support of
ULL’s July application to TfL and to the Deputy Mayor for Transport,
Heidi Alexander, copied to the TfL Board. TfL has also had regard to aletter from Uber’s CEO, Dara Khosrowshahi, received on 24 November
2019 referring to Uber’s commitments to public safety, amongst otherthings.
5. The overall tone and content of the correspondence from ULL, since theChief Magistrate’s decision, has been productive and, in the main,transparent. ULL has demonstrated its commitment to finding ways toaddress issues and concerns raised by TfL. ULL has also apologised to
TfL for any areas in which it has failed to properly escalate issues andhas also acknowledged the legitimacy of TfL’s concerns. As is expectedfrom a regulated entity, the overall tone of ULL’s correspondence has
been respectful to TfL as its regulator. These points are not usuallysomething that TfL pays attention to when determining if an operator is a
fit and proper person, but this is relevant for ULL because its historic
practice was to correspond with TfL in a dismissive or cursory manner.
(b) Reporting driver behaviour and police engagement
6. One of TfL’s concerns, when refusing ULL’s licence in 2017, was ULL’s
failure to report serious driver misconduct (including in some cases
criminal behaviour) to the police. At TfL’s request, prior to the June 2018
hearing, ULL carried out a review of historic complaints that had beenbrought in respect of driver behaviour, in order to determine whether theyshould be referred to the police.
7. Shortly before the licensing appeal, TfL wrote to ULL about the historiccomplaints review and asked about cases that were outside of theMetropolitan Police Service’s (“MPS”) jurisdiction. In a letter dated 22
June 2018, ULL provided an update on that review. It referred to 18
cases that fell within the jurisdiction of seven different police authorities
and confirmed that it had contacted all of those relevant authorities. At
that time, it stated that it was in discussions with the relevant police
authorities as to what further steps they wanted ULL to take.
8. ULL’s historic complaints review was also discussed at a regulatory
meeting on 14 November 2018 between TfL and ULL. In its letter of 7
February 2019, TfL asked ULL to provide an update on the discussions it
had with the police authorities outside of London about the 18 cases andwhether the drivers concerned remained ULL drivers. TfL also asked forPage 6 of 62

an update on the progress of agreeing an approach to reporting
allegations of criminal behaviour with police authorities outside London.
9. In an update of 22 February 2019, ULL stated that it had now put inplace a comprehensive crime reporting process underpinned bydedicated staff to ensure accurate, timely reporting of allegations to thepolice each week. ULL said that it had reported each of the 18 drivers to
the relevant police forces but only received a request for further driverdetails from one of them. It confirmed that each of these 18 drivers had
their access to the app permanently revoked and had submitted a driverdismissal notification (PHV105 form) to TfL.
10. ULL also explained the work it has done with the Metropolitan police andBritish Transport Police (BTP):a) Metropolitan Police’s intelligence unit has access to ULL’s 24/7 Law
Enforcement Response Team and portal;b) The Head of the Metropolitan Police Taxi and Private Hire Unit
intended to share ULL’s approach to reporting with the College of
Policing, which would help inform a national reporting protocol for taxi
and private hire operators;c) Carried out work with the police in relation to counter-terrorism andpreventing modern day slavery;d) BTP wanted to work more closely with Uber in the future.
11. On 6 September 2019, ULL provided a further update on its relationships
and arrangements with police forces outside of London and said:a) Feedback was awaited from the Head of the Metropolitan Police Taxi
and Private Hire Unit and the College of Policing with regards torolling out an approach to police reporting across the UK;b) Commitment from the Home Office to implement the national ‘Single
Online Home’ across the country enabling efficient reporting ofpotential crimes in a structured and consistent manner to forces
across the UK.
c) Established and trained a single point of contact and rolled out its
24/7 Portal to 36 of the 45 forces in the UK.
d) Recruiting a second dedicated police liaison officer to provide greater
support to the police as this process is rolled out.

Page 7 of 62

12. ULL notified TfL on 11 September 2019, that Chief Constable MarkCollins had been appointed the Uber UK Liaison, a role in which he will
act on behalf of Police Chiefs nationally in a number of ways, including
helping to direct and set the strategic areas Uber should focus onnationally, advising and guiding on how ULL’s Law Enforcement
Response Team should engage with UK police forces and act as a pointof contact for Uber, escalating any national policing concerns to ULL andalso helping it coordinate and roll out initiatives across the country.
13. On 21 November 2019, ULL provided TfL with the notes of a meeting it
had held with the MPS on the 7 November 2019. This highlighted theongoing working relationship between ULL and the MPS. The notes
record a discussion about the progress of ULL’s reporting arrangements
to the MPS. The notes of the discussion show that there were no issues
from a policing perspective with ULL.
14. Overall, it is clear that ULL has committed significant resources into
ensuring that it has a good ongoing relationship with the Metropolitan
Police. It is also evident that ULL has also sought to expand its
relationship with other police and criminal enforcement agencies to assist
in the prevention of crime related to trips undertaken by ULL drivers or
passengers. This is important work and shows a commitment by ULL to
the personal safety of its passengers and drivers that was previously
lacking at the time of TfL’s 2017 decision.
(c) Data management
15. ULL has explained in correspondence the approach that every Ubergroup company, including ULL, takes to the protection of passengers’
and drivers’ data and has affirmed that this issue is treated with theutmost seriousness. Uber Technologies Inc. (‘UTI’) has appointed a
Chief Privacy Officer and the Uber Group has developed six principles
for handling data, as well as put other resources and arrangements inplace to support its culture and commitment towards protecting personaldata.
16. In accordance with its conditions, ULL has notified TfL of potential data
breaches in relation to:a) A third party contractor called Typeform. On 2 July 2018, ULL
informed TfL of a passenger and driver data breach at Typeform(which lasted no longer than 30 minutes). The matter was escalated
to the ULL executive directors and Uber BV Privacy Legal team thatday. Typeform notified the ICO and data authorities in the
Netherlands immediately.

Page 8 of 62b) Another third party contractor called SparkPost. On 16 November
2018, ULL notified TfL that ‘SparkPost’ had inadvertently sent email
address data concerning Uber users to other customer(s) of theirs(the incident occurred due to a technical error on 18 October 2018).
SparkPost confirmed that the customer who received that data has
confirmed that it has been deleted.
c) On 11 December 2018, ULL’s app phone number anonymisation
suffered a system outage for two hours. As a result, the personal
telephone details of a driver were provided to a passenger and thepassenger’s details were available to the driver. ULL informed TfL ofthis on 14 December 2018. This matter was considered by ULL’s
Licensed Operations Management Committee (‘LOMC’) on 11
December 2018. ULL later confirmed that investigations to dateindicated that no data breach had occurred.
d) On 24 August 2018, ULL notified TfL of a police investigation that had
been carried out by West Midlands Police concerning a suspect who
had compromised the accounts of thousands of customers of a wide
range of international companies, including Uber. The police
confirmed that the emails and passwords had been sourced from theinternet and not Uber’s systems. It said that it checked the informationthat the police had available and confirmed to the police that there
had been no data breach of Uber’s systems. The police confirmedthat they did not require further support or involvement from Uber in
relation to this case.
17. Earlier in 2019, TfL challenged ULL about its engagement with theInformation Commissioner’s Office (ICO), because following notificationsof the above incidents, we were not confident that the proper approach
had been taken to engaging with the ICO about any potential breaches.
TfL wanted to be confident that ULL was fully and transparently engaging
with the ICO in appropriate cases. TfL’s concerns arise from a previous
2016 data protection breach where Uber (not ULL) did not report itself tothe relevant data protection authorities and instead paid money to thehacker (paragraph 19).
18. ULL wrote to TfL on 17 May 2019 about its engagement with the ICO
and the Dutch Data Protection Authority (DDPA) on issues that may
potentially amount to data breaches. In the course of correspondence,
ULL confirmed that:a) It had sought the ICO’s assurance that its data policies, practices andconduct are consistent with their best practices;

Page 9 of 62b) The ICO’s position is that the onus is on the third party to determine
whether or not a breach has occurred, and the ICO provide support tothird parties in making self-evaluations, including the decision-tree
that should be used to determine whether or not there has been adata breach;c) It has established lines of communication to the ICO and DPPA;d) It raised TfL’s comments with the ULL Board and at the Board
meeting on 25 April 2019, it was noted that Uber’s Data Protection
Officer would continue to engage in dialogue with the ICO.
19. In its evidence to the Chief Magistrate in June 2018, TfL referred to thedata breach of Uber’s systems in 2016. TfL was given notification of thebreach in November 2017, and it later emerged that over 2.5 million ULL
accounts had been compromised (both customer and driver), and that
Uber paid the hackers $100,000 to secure the return of the data in 2016.
The data breach had been reported to the DDPA and the ICO, whichwere investigating the breach. TfL made clear to the Chief Magistrate inJune 2018 that it had concerns about this breach (in particular its size)and ULL’s response to it.
20. In September 2018, TfL became aware, through the press, that asettlement had been reached in the US between Uber and the attorney
generals for $148 million in relation to the 2016 data breach. TfL wasdisappointed that ULL had not given notification of this before it
appeared in the press. ULL apologised for not providing prior notification
to TfL.
21. On 26 November 2018, ULL told TfL that the ICO would be publishing amonetary penalty notice, including a fine totalling £385,000 against
Uber’s UK businesses (Uber London Ltd, Uber Britannia Ltd, Uber Scot
Ltd and Uber NIR Ltd) and Uber BV citing a serious contravention of theseventh data protection principle. The email also said that ULL wasinformed that the DDPA would be announcing the conclusion of its
investigation and issue a fine of €600,000 against Uber BV and Uber
Technologies Inc. (UTI) for violating the Dutch data breach regulations.
22. ULL confirmed that the ULL Board was notified of the level of the fine
imposed by the ICO and the publication of the MPN on the day prior to it
becoming public. The Board has not agreed to take any new steps as aresult of the MPN, due to the work on data security and privacy which
has already been undertaken on a global basis since the 2016 data
breach was exposed, including termination of employment of individuals
responsible for concealing the breach, improvements in security systems
and new data security processes introduced. ULL fully accepted thePage 10 of 62

fines imposed by the ICO, by the DDPA and the US which reflect theseverity of the issue and said that it has been open in its criticism of thehandling of the breach.
23. TfL recognises the extensive work that Uber BV, UTI and ULL have done
over the last couple of years since the 2016 data breach came to light.
There has been significant change to processes and personnel to ensurethat a similar incident does not happen again, and to ensure that there
are clear and strict governance arrangements in place around this area.
There is a clear shift in approach to these types of issues and an
appropriate emphasis on ensuring the data of its passengers and drivers
is afforded a high level of protection.
24. This view is reinforced by Cognizant’s findings that ULL’s systems andprocesses with regard to vulnerability management, network security,
cyber security risk management and security incident management wereat or above the standard that Cognizant would expect of a company in
ULL’s position.
(d) ULL’s operating model and technical review
25. In 2017, TfL wrote to ULL about its operating model because it was notsatisfied that ULL was accepting bookings at its licensed operating
premises in London, and said that it was minded to conclude that ULL’s
business model did not comply with section 2 of the 1998 Act. In
response, ULL made changes to its operating model and reconfigured
the Uber App in order to improve transparency and demonstrate evenmore fully that it is accepting bookings.
26. In its 3 July 2019 application for a London PHV operator’s licence, ULL
provided TfL with a detailed description of the way in which its operating
model worked, and its November 2019 application confirmed that there
were no changes to this information. As it had done in 2018, TfL asked
Deloitte UK to visit ULL and produce a report showing the processes forbookings and cancellation of bookings in order to inform its conclusions
concerning whether or not those systems still comply with the 1998 Act.
27. Deloitte UK visited ULL on 24 July 2019 and ULL demonstrated its
system. Deloitte UK looked at the following processes:a) Booking Process.
b) Rider-Initiated Cancellation Process.

Page 11 of 62c) ULL Cancellation Process (Rider does not meet the driver; ULL
cannot find a driver; and, Driver withdraws availability).
d) Scheduled Ride.
28. Deloitte UK’s final report to TfL, on 28 August 2019, confirmed that theprocesses above remained as they were in 2018, when it previously
assessed ULL’s systems. Deloitte UK also considered the new featuresand updates to the Uber App since the previous report in 2018, most ofwhich have been communicated to TfL. It concluded that none of those
new features or updates had altered the overall structure of the ULL’s
booking processes. Deloitte UK also considered various other mattersthat had arisen in the intervening time, including some driver complaints
about the app and its operation. It concluded that none of those issues
changed its views on ULL’s booking processes.
29. It is noted that ULL’s process flows for bookings and cancellations havenot changed since they were made in 2018. Deloitte’s process flows
show that bookings are accepted by ULL before they are allocated to adriver and the cancellation process is controlled by ULL with no driverinteraction other than to notify ULL that the driver cannot fulfil thebooking. It is considered that ULL’s operating model, since the changes
made in 2018, complies with the legislative framework.
(e) TfL’s compliance inspection
30. Prior to granting a PHV operator’s licence, TfL carries out a pre-licensing
inspection of the applicant operator’s premises. This check enables TfL
to ensure that both the applicant and the premises are fit to be licensed
and to check whether the operator is able to adhere to all the licencerequirements before a decision is made. The inspection of any proposed
operating centre is carried out by a TfL Compliance Officer (“CO”).
31. Section 4(3)(e) of the 1998 Act states:“A London PHV Operator shall…at the request of a constable orauthorised officer, produce for inspection any record required by thissection to be kept.”
32. TfL ordinarily carries out its first compliance inspection within six to eightweeks of a licence being granted. Thereafter, TfL will carry out
announced and / or unannounced compliance inspections of licensed
PHV operators and their premises from time to time. An unannounced
inspection may be carried out as a result of intelligence received or thePage 12 of 62

identification of non-compliance when carrying out on-street checks ofdrivers and vehicles.
33. The announced compliance inspection of ULL’s operating centre took
place between 10 and 12 July 2019, and was undertaken by 20 COs,
who applied the ordinary standard in inspections of this kind. The
purpose of the inspection was to verify that ULL has in place thefollowing as a minimum:a) Customer booking confirmation and overall booking processes for all
bookings;b) A system for providing accurate fare estimates;c) A system for creating and retaining driver and booking records;d) Any new requirements set out in regulations changes;e) A full set of vehicle records including insurance certificates and Motor
Insurance Bureau records;f) Records of complaints and lost property, which included thecomplaints that have recently been investigated as referred to above(a thorough check was undertaken on ULL’s new driver dismissal andcomplaints process);g) Advertising to ensure it complies with section 31 of the 1998 Act;h) Relevant documents either held or displayed at the operating centre,
such as public and employer liability insurance, operator’s licence and
VAT registration certificates.
34. During the course of a compliance inspection, each item of noncompliance with the 1998 Act and the relevant PHV regulations isscored. At the end of the inspection, operators are given an overall score
between one and seven. Operators are then given a series of follow-up
actions within various categories. These are based on the Grading
Categories guidelines.
35. Operators are given an opportunity to rectify any identified areas of noncompliance during the inspection, before it is finalised.
36. The Compliance team undertook a small sample check during thecompliance inspection. They checked driver and vehicle records
bookings between two separate ten minute periods on two different daysat the end of June 2019. Overall, the records for 6,161 drivers andPage 13 of 62

vehicles were checked. The sample checked was relatively small andchecks of this kind are, of course, not capable of uncovering all possible
issues. However, the inspection did not reveal any systemic issues thatraised concerns.
37. The inspection did not reveal any other areas of concern or noncompliance by ULL. TfL provided confirmation of this to ULL at the endof the inspection.
(f) ULL’s management structure and governance
38. Prior to the appeal hearing in June 2018, Uber global underwent asignificant number of senior personnel changes, including a number ofhigh profile dismissals of those who were involved in the issues that had
previously affected Uber’s reputation, including the 2016 data breach.
Uber global also made a number of key appointments to its senior
management team and Board. Some senior management changes also
took place at ULL, including the departure of the previous General
Manager for the UK and Ireland, Jo Bertram.
39. Since the grant of a licence by the Chief Magistrate in June 2018, themanagement structure of Uber global and ULL has continued to change,
including the appointment of a new Chief Privacy Officer, a Data
Protection Officer, and a Chief Trust and Security Officer for Uber global.
In addition, ULL appointed a new Head of Compliance for the UK and
Ireland, James Heaton-Smith, and appointed Jamie Heywood as
Regional General Manager for Northern and Eastern Europe. Tom
Elvidge who was ULL’s General Manager for UK and Ireland, left ULL in
April 2019 and was replaced with Melinda Roylett in August 2019 asGeneral Manager for UK and Ireland.
40. In accordance with condition 1 of the conditions imposed by the Chief
Magistrate and following the 24 September 2019 decision, the ULL
Board continues to have an independent Chair, currently Laurel PowersFreeling, with a majority of independent members. In the Chair’s letter to
TfL supporting ULL’s licence application, she commented that the Board
has become a “unified body, with clarity as to both ULL’s uniquebusiness model and responsibilities, as well as its relationship to UTI andULL executives.”
41. Ms Powers-Freeling refers to “documents and dialogue” provided to theBoard each month which she says provides the Board with evidence thatthe changes to “ULL’s systems, procedures and perspectives” are“effective and embedded”. Ms Powers-Freeling also said that ULL

Page 14 of 62

demonstrates that its “commitment to transparency and compliance is agenuine and permanent element of the organisation’s culture”.
42. Ms Powers-Freeling also refers to the relationship with Uber global andsays that the Board has been given “the visibility, authority and autonomy
to take full responsibility for ULL’s regulatory obligations and to direct
ULL to take specific actions to ensure compliance, including where theymight diverge from the global corporate position”.
43. The Board underwent an independent Board review in April 2019 which
Ms Powers-Freeling refers to in her letter. It was undertaken by
Independent Audit Limited (‘IAL’). Ms Powers-Freeling reported that IAL
gave positive feedback to the Board as well as recommendations fordevelopment, and endorsed the governance structures the Board has
put in place, “highlighting both the strong functioning of the ComplianceProtocol and the “transparency and openness” of the dialogue between
the Board and senior management”. IAL commented that the Board “hasreached a surprising level of maturity given the fact it was establishedonly very recently” and that “it has developed to a point which is not far
out of line with the way we see boards operating in much more wellestablished (and bigger) organisations.” Further details of IAL’s findings
were provided in the June 2019 assurance report.
44. Since April 2019, the Board has shared with TfL after each monthly
meeting a summary of the issues discussed. It is evident from thesesummaries that the Board is concerned about customer safety and that it
holds the ULL operational team to account. There is no requirement on
ULL to share these summaries but TfL finds them useful to understandthe Board’s focus. Laurel Powers-Freeling, as Chair of the Board, has
met TfL on several occasions since June 2018 to provide feedback on
the ULL Board’s role both within ULL and Uber global. In addition, sincethe 24 September 2019 decision, Ms Powers-Freeling has provided theminutes of the ULL Sub-Committee. These meetings provide a useful
insight into the structure of the ULL Board and autonomy given to the
ULL Board by Uber global. TfL has used these meetings to ask the ULL
Board to ensure focus on specific issues.
45. The June 2019 Assurance Report referred to a number of governancearrangements that ULL has in place which includes:a) The Compliance Steering Group – responsibility to review theoperation of the Compliance Protocol and the resolution of all mattersof concern during the previous three months.

Page 15 of 62b) The Supervisory Group – made up of the Chair of ULL Board, Chief
Legal Officer of UTI and CEO of UTI which meets annually to review
the operation of the Compliance Protocol.
c) Breach Reporting Policy – helps ULL to manage breaches of its
regulatory obligations and internal policies. Breaches are recorded in
the breach register which is a centralised record, the breach isassessed by the LOMC and can be referred to the ULL SubCommittee and the ULL Board for consideration; consideration ofwhether the breach should be communicated to TfL; appropriate
action is determined and once taken, the breach is marked as
resolved.
46. TfL considers that the ULL Board has helped ULL to change its culture
and ensure that it is transparent and cooperates with TfL as its regulator.
Without the strong steer and guidance from the Board and particularly
the Chair of the Board, Laurel Powers-Freeling, TfL does not consider
that ULL would have been able to overcome some of the issues thatwere of concern at the time of the 2017 decision and certainly not within
the timescales ULL has achieved.
47. Following the ITSM service management maturity assessment carriedout by Cognizant, TfL has a greater understanding of the LOMC’s role,
when changes are being made to the London specific configuration of
the Uber app. All changes that have been designed by the Uber Global
team are assessed and approved by the LOMC to ensure that thechanges are appropriate and compliant with the local rules andregulations for London.
48. However, Cognizant has also stated that the LOMC are not best placed
to determine if the technical change would introduce a vulnerability into
the app or other undesirable outcomes. Cognizant were not provided
evidence that there is anything other than a light testing process toensure that the change works rather than a wider testing process thatlooks to identify unintended consequences of the change or othervulnerabilities that could be exploited. This suggests that the LOMC (andsubsequently, the Board) is not in a position to be confident – when it
approves changes – that they will not give rise to vulnerabilities within theoverall Uber system, that might be exploited by drivers (or potentiallythird parties). We return to this point in the next section below.
49. The Board (and LOMC) also relies considerably upon its operationalteam to bring matters to its attention. That has not always taken place as
it might have done. For example, the driver photo fraud issue was not
escalated to the LOMC and the Board’s attention until March 2019
following two passenger complaints, even though the first occurrencePage 16 of 62

took place in October 2018. Also, the LOMC had decided to report an
issue about an unauthorised app to TfL, in advance of a quarterly
meeting in July 2018 with TfL but did not do so due to an oversight.
50. Furthermore, there have been some indications to TfL that some of
ULL’s new senior officers have not fully understood the nature of theregulatory regime within which ULL operates, or the nature of ULL’s
relationship with TfL as regulator. For example, following the decision to
grant ULL a licence for 2 months, ULL’s General Manager for Northernand Eastern Europe is reported as saying in an article for City AM on 30
September 2019 that the outstanding issues TfL was seeking from ULL
were merely “administrative”. That was misleading and inaccurate, anddid not reflect the substance of TfL’s decision. It was also concerning as
it suggested that ULL had not appreciated the seriousness of the issues
that TfL was considering and on which it was seeking clarity. These
comments, among other matters explored in this decision suggest to TfL
that even following personnel changes, there remain somemisunderstandings within ULL’s senior operational management inrelation to the licensing environment and TfL’s role within it.
51. Nonetheless, the overall picture in relation to ULL’s management is
positive. The leadership of the company, as a whole, has significantly
improved since the 2017 decision and is now in a healthier state.
g) Programme ZERO
52. ULL’s Board has commissioned a new programme, Programme ZERO,
which aspires to drive the rate of ULL’s regulatory breaches that it has
experienced (see below) down to zero or as close to zero as possible.
There are five workstreams in Programme ZERO which are:a) Workstream A focuses on tools and processes related to document
review and approvalb) Workstream B focuses on tools and processes related to condition
12b (the requirement to suspend or dismiss a driver and notify TfL
within 48 hours of receiving a safety related complaint concerning adriver)c) Workstream C focuses on tools and process related to Regulation
9(4)(c) (the requirement to notify TfL within 14 days of a driverdismissal)d) Workstream D focuses on tools and processes related to condition 5(the requirement to provide TfL with 28 days notification of any

Page 17 of 62

material changes to the operating model, systems or processes, that
may affect compliance with ULL’s regulatory obligations)e) Workstream E focuses on further enhancements to the tools andprocesses ULL uses to manage potential breaches when they are
identified.
53. The June 2019 Assurance Report, covering the period from 1 December
2018 to 31 May 2019), referred in detail to Programme ZERO and to theimpact of it in a chart showing that breaches of condition (other thancondition 12b, requiring ULL to notify TfL of any decision to suspend or
remove a driver from the platform within 48 hours) had reduced from 38
in the first quarter of 2018 to 14 in the first quarter of 2019, and to 3 in
the first two months of the second quarter of 2019. It also referred to a
gradual reduction of breaches of condition 12b since 1 January 2018.
54. The June 2019 Assurance Report set out in some detail the changes thathave been introduced to personnel and systems under each of the five
workstreams under Programme ZERO. Some of these changes include
the recruitment of 40 agents to support a second manual document
review check (four-eye principle) and the pre-approval of all driver andvehicle related documents submitted to ULL, recruitment of 30 new
safety support agents to improve the compliance with condition 12b,
refresher training for agents reviewing documents and safety complainttaxonomy and correct escalation guidelines. The changes that havebeen made are considerable.
55. The October 2019 report, covering the period between 1 June and 30
September 2019, gave a further update on the success of ProgrammeZERO and the changes that had been made since 1 June 2019. It also
referred to a new Workstream (Workstream F) being added that focuses
specifically on document fraud. Changes delivered through thisWorkstream F include:a) New processes to inform TfL at the conclusion of each investigationof potential document fraud (whether the driver is deactivated or not)and to provide TfL with a monthly summary of all open investigations;b) Six additional agents to focus specifically on investigation of potential
document fraud cases and one additional agent to undertakecompany validations;c) Meeting with senior representatives from the Motor Insurance Bureau
to discuss how they might work together to jointly address the issueof fraudulent insurance documentation within the industry

Page 18 of 62

56. TfL recognises the significant improvements that Programme ZERO has
made. It demonstrates ULL’s commitment to reduce regulatory breaches.
We consider that Programme ZERO has produced some positivechanges and new initiatives in ULL’s operations.
Conclusion
57. The above factors all support the conclusion that ULL is fit and proper tohold a PHV operator’s licence. These factors have been taken into
account in the decision as to ULL’s fitness.
FACTORS THAT HAVE LED TO TFL’S CONCLUSION THAT ULL IS NOT NOW A FIT
AND PROPER PERSON TO HOLD AN OPERATOR’S LICENCE
58. However, TfL concludes ULL is not a fit and proper person to hold a PHV
operator’s licence in London. In summary, that decision is made for thefollowing reasons:
59. All of the positive matters set out above are acknowledged, and havebeen taken into account.
a) However, in the period since the Chief Magistrate granted ULL alicence, in June 2018, ULL has reported various regulatory breaches
to TfL. Some, indeed many, of those breaches have been extremely
serious in nature. By way of example:i.

Some of those breaches have concerned cases in which
drivers were providing PHV services without hire and reward
insurance in place. This is a particularly serious issue and is of
critical importance from the perspective of public safety. The
risks to the public of uninsured drivers, offering uninsured
services, are grave and acute.

ii.

As set out above, at paragraph 12(b)(ii) some of thosebreaches have concerned cases in which individuals were
providing PHV services, via the Uber app, using anotherdriver’s account details. That is considered to be an
unacceptable and very grave risk for the reasons set out.

b) These breaches, along with others detailed below, have flowed, atleast in part, from a variety of different vulnerabilities within Uber’ssystems (that have been exploited by drivers) as well as human error(in some cases). ULL has taken a number of steps to address thesebreaches and the number of those incidents is currently falling.

Page 19 of 62c) However, these breaches, when viewed together, raise a serious
question as to whether TfL has sufficient confidence in ULL’s ability toprevent incidents of that kind occurring in the future, in part because
at least some of them appeared to derive from weaknesses within
ULL’s systems and service management processes.
d) ULL provides TfL with biannual Assurance Reports. Those reports
have improved over time. However, in certain important respects,
those reports have failed to recognise and prioritise serious breachesof the licensing framework, such as those set out below.
e) As a result of its lack of confidence in ULL’s ability to prevent newincidents of this kind occurring, TfL commissioned a report by
Cognizant, a systems and security expert. TfL commissioned thatreport in the hope that it would provide it with sufficient confidence
that ULL’s processes, IT service management (including change,
release, incident and problem management) and cyber security wereat or above industry standard for an organisation such as ULL. Thatwould have provided TfL with reassurance as to ULL’s fitness andpropriety to hold a PHV operator’s licence.
f) As set out in more detail below, the Cognizant report into ULL’s IT
service management rated ULL as below the standard that would be
expected of a company in its position. As a consequence, this does
not provide TfL with sufficient confidence that the kinds of serious
breaches described above will not recur.
60. In all these circumstances, TfL concludes ULL is not a fit and proper
person to hold a PHV operator’s licence.
ULL’s breaches of the licensing framework(a) Insurance related concerns
61. Three different matters have arisen, in the period since June 2018, in
relation to the provision of PHV services without insurance via the Uberplatform. ULL has a statutory obligation to keep a copy of the current
private hire and reward insurance certificate of any driver on its platform
before allocating private hire bookings. Failure to do this is a criminal
offence under section 4 of the 1998 Act.
62. It goes without saying that insurance is very important within the private
hire sector. Each of the following matters has been a cause of major
concern to TfL and has contributed to the TfL conclusion that ULL is not
fit and proper to hold a PHV operator’s licence.

Page 20 of 62(i) Uninsured vehicles
63. On 7 October 2018 during a routine on-street compliance check, TfL
identified a ULL driver who was available to work on the ULL platform
who did not have valid hire or reward insurance. ULL gave further details
on 30 October 2018 confirming that the driver had been dismissed, that
ULL had reviewed all active insurance documents on its system (inexcess of 60,000 documents), and through this review, had identified afurther 4 drivers with incorrect insurance cover.
64. Further correspondence took place between TfL and ULL about theseinsurance breaches and in a letter dated 22 February 2019 to TfL, ULL
confirmed:a) LOMC and the ULL Board had directed ULL to conduct a thoroughassessment of the system for reviewing and approving insurance
documents which resulted in re-training staff to correctly checkinsurance documentation.
b) It had contingent liability insurance policy which it said would provide
coverage for any third party as a result of a claim arising from anincident during the provision of transport services using the Uber app
where insurance is not otherwise available.
c) The failure was the result of a manual error.
d) It had reviewed 30,000 insurance documents in October 2018 (thiscontradicted its earlier notification to TfL that over 60,000 documents
had been reviewed).
e) It, and the Board, have zero tolerance for any incident that puts at risk
the safety of passengers and drivers.
65. In relation to ULL’s contingent liability policy, TfL has taken advice on thispoint and does not consider that this policy would discharge ULL’s
liability under the Road Traffic Act 1988, and is unlikely to provide
adequate insurance cover in circumstances where the driver does nothave hire and reward insurance in place.
66. TfL noted that each of these drivers who were driving without hire andreward insurance had carried out multiple bookings. Two of the drivers
undertook over 1,400 bookings between them over an extended period.
Also, in breach of the Operator’s Licence Regulations, ULL had not kept

Page 21 of 62

a copy of the current certificate of insurance, or certificate of security, in
relation to those drivers.
67. In 2014, ULL was prosecuted and convicted for the offence of causing or
permitting drivers to use vehicles on a public road for hire and reward
without the requisite motor vehicle insurance policy. Following thatconviction at the time, TfL decided not to suspend or revoke ULL’slicence but instead warned ULL that the conviction would be taken into
account should TfL have any further cause to consider regulatory action
against ULL in the future. At that time, ULL described the steps it was
taking to prevent anything similar happening again in the future. In lightof this latest incident, TfL considered what fresh action to take, if any.
68. After carefully considering ULL’s submissions, TfL prosecuted ULL for
the offences of “causing/permitting the use of a motor vehicle on a publicroad without insurance” and “failing to comply with statutory record
keeping obligations”. In total, ULL faced four criminal allegations, in
relation to two drivers. The two ULL drivers concerned were also charged
with using a motor vehicle on a public road without appropriate motor
vehicle insurance. On 31 July 2019, ULL pleaded guilty to each of thefour offences and were fined a total of £28,800, ordered to pay TfL’s
costs of bringing the prosecution of £22,470 and a victim surcharge of£170. Each of the drivers also pleaded guilty at the same hearing andwere also fined and ordered to pay costs.
69. At the hearing, the judge said that ULL should have learned the lessons
from the previous conviction arising out of an insurance breach in 2014
and that the offences were regrettable and avoidable.
70. The various aspects of this matter which call ULL’s fitness and propriety
into question are:71. This is the second time that ULL has been prosecuted in relation to
insurance offences. As noted by the judge at the hearing, ULL shouldhave learned the lessons from the previous conviction and the 2018
offences were regrettable and avoidable. Although only two drivers wereprosecuted, there were 12 drivers in total who were drivers for ULL
between early 2018 and October 2018 that were found not to have hire
and reward insurance in place and those drivers potentially undertook
thousands of trips with passengers. This has significant safety
implications for passengers and other road users.
72. TfL notes that ULL believed that the contingent insurance policy would“plug the gap”, should there be any issues arising with the insurance
documents held by drivers. TfL indicated to ULL in 2014 that thecontingency liability policy ULL had in place at that time was insufficient.

Page 22 of 62

TfL was surprised that ULL had again sought to rely upon it. It isconsidered that ULL should have taken adequate steps to ensure that
there was no gap in insurance cover by drivers by meeting their
obligations and ensuring drivers have the correct hire and reward
insurance in place rather than relying on the contingency insurance
policy.
73. Since this issue came to light, ULL has put further systems in place
which include:a) Improvement to its electronic and manual processes.
b) Reviewing all other insurance documents it held for drivers to identify
if there were any other failures.
c) Close involvement of the Board which directed a number of actions
be taken to find out why these failures occurred and to put in placeactions to prevent them occurring again.
d) The Board, and ULL as a whole, has committed to zero error in
relation to breaches.
e) Invested resources in eradicating errors, both in the form of new staff
and new technological solutions.
f) Communicated proactively with TfL on this issue and readily shared
information with TfL once it emerged.
g) Continued engagement with several
specialising in taxi and private hire.

insurancecompaniesh) Further extension of ULL’s Instadoc system to additional insurance
providers, enabling insurance documentation to be submitted directly
to Uber by the insurer.
74. TfL considers that this second breach of the criminal law in relation to
insurance is significant and provides a strong indicator that ULL is not a
fit and proper person to hold a PHV operator’s licence. The provision ofuninsured PHV services is a matter of the utmost seriousness to TfL: it
exposes the public to an unacceptable risk and places their safety inperil.
75. At the time of the convictions, ULL’s PHV operator’s licence was shortly
due for renewal, and it was therefore considered appropriate that theconvictions should be considered alongside all the available evidence, in
the round, when ULL’s licence was renewed. The steps that ULL has

Page 23 of 62

taken to address the failings in this matter have been noted, but there
remains concern that this issue has occurred twice since ULL was
originally licensed in 2012. ULL’s criminal conviction (and the relevant
background) has accordingly been taken into account in this decision aspart of the overall assessment of ULL’s fitness and propriety to hold a
PHV operator’s licence. TfL adopts a similar approach in relation to other
PHV operators. Thus, TfL took into account as a serious matter aconviction against an operator for causing/permitting the use of a vehicle
on a public road without insurance when considering the fitness of that
operator. In some of these other cases this factor – amongst others - has
led to the PHV operator’s licence being revoked.
(ii)

Premature acceptance of insurance
76. On 19 July 2019, ULL notified TfL of a further issue that had resulted in a
number of drivers driving passengers without hire and reward insurancein place. Drivers are able to upload an insurance certificate to ULL’s
systems and TfL had identified that it was possible for its agents toapprove those certificates in error. It had identified a number of instanceswhere that error had been made, and the drivers concerned had taken
trips before the start date of the insurance policy.
77. ULL said that it identified 9 drivers who took trips on insurance
certificates which had been prematurely approved, with 252 trips takenby those drivers in the period between the insurance certificate being
approved and the cover actually commencing.
78. In early August 2019, of the 9 cases, there were two in which it was
unclear whether insurance was in place at the time those trips weretaken.
79. TfL recognises that ULL took immediate action to address this issue andhas prevented this from happening again. However, having appropriate
insurance in place is a basic requirement for operators. ULL’s failure toensure that this is the case is a significant breach of its obligations andraises real safety concerns.

(iii) Fraudulent documents
80. This is an issue that is somewhat broader than insurance. In the period
since the Chief Magistrate granted ULL a licence, ULL has notified TfL of
a number of incidents in which fraudulent documents have been
uploaded to their platform, or relied on by drivers. Two points are madeby way of introduction:

Page 24 of 62a) TfL is concerned that it had to encourage ULL to review fully not only
insurance documents that may potentially be fraudulent, but also otherdocuments such as MOT certificates, DVLA driver licences and TfL PHV
driver licences. Without TfL’s intervention, there is no confidence thatULL would have itself taken the initiative to broaden its review and treat
other suspicious documentation in the same way as insurance
documentation.
b) As set out more fully below, ULL’s historic practice, now altered, was toallow drivers to continue driving, while it investigated whether or not their
documents (including insurance documents) were fraudulent. It isconsidered that this is not consistent with the serious nature of this issue
and the dangers presented to the public by uninsured PHV services.
81. This issue of fraudulent insurance documents was first brought to TfL’s
attention by ULL on 4 February 2019 although at that time, TfL does notconsider it was properly escalated to TfL via normal established routes.
ULL referred to 6 cases in which drivers had modified insurance
documents to appear current when they had expired. Two of the drivers
had not taken any trips but overall, the total number of trips taken by theremaining 4 drivers was 172. In its letter of 22 February 2019, ULL
referred to these 6 cases and a further 6 cases it had found of drivers
undertaking trips with fraudulent insurance documentation.
82. TfL was concerned about these issues of fraudulent insurance and met
with the Chair of the ULL Board, and the Regional General Manager for
Northern and Eastern Europe on 11 April 2019 and asked ULL toinvestigate this matter urgently and to provide TfL with full and frankinformation on the issue. TfL also wrote to ULL about these cases on 25
April and 30 April 2019, seeking further details about these cases.
83. TfL and ULL met on 2 May 2019 and ULL provided more details about
the 12 cases and explained its approach to handling them. It confirmedthat of the 12 cases, ULL had reported 10 of them either to Action Fraudor via a Witness Statement to the MPS. Two cases were from 2015 and2016, and pre-date the established processes with the MPS. ULL also
wrote to TfL on 16 and 17 May 2019 in which it said that it had
developed new ways to improve the effectiveness of its controls andreduce weaknesses which drivers may seek to exploit.
84. ULL said that it did not believe that these issues reflected a wider issue
and that it believed it had sufficient controls and assurance processes inplace to identify and deal with such cases. It said that since 1 January
2018, it is aware of 45 cases where a driver has been dismissed due tosubmission of a fraudulent document which it says represents 0.00145%

Page 25 of 62

of all documents submitted to Uber by TfL licensed drivers over that
period. These 45 cases include:a) 35 insurance documents;b) 3 MOT certificates;c) 3 Private Hire Driver Licences;d) 3 Private Hire Vehicle Licences;e) 1 Supporting Insurance Document.
85. ULL provided a further update on its investigations on 9 August 2019.
ULL said that, since the meeting on 2 May 2019, it logged and sharedwith TfL 27 further suspicious documents (insurance, PHV driver’s
licences, V5 Vehicle logbook and MOT certificates) which it suspected
might be fraudulent. ULL confirmed that of these, there were 20 cases
where the document issuer has confirmed that the document isfraudulent and ULL was seeking information from the driver to ascertain
the driver’s role in the fraud; 5 cases in which ULL was waiting for the
document issuer to confirm whether the document is fraudulent; and 2
cases in which the document issuer confirmed that the document is not
fraudulent. ULL also confirmed that in 17 of the cases, the driver’s
concerned did not take any trips prior to the fraudulent document being
identified. However, TfL noted that some drivers were able to undertake
journeys and in one case of a fraudulent insurance certificate, the driver
took 801 trips before the document was flagged as being suspicious.
86. TfL was concerned that a number of drivers were able to carry out trips
without insurance. However, it is recognised that some fraudulent
documents, particularly insurance documents, are sophisticated anddifficult to identify. ULL has now put in place additional training andmechanisms with insurance providers to identify those documents.
87. TfL was also concerned about the manner in which ULL responded when
it first identified that a document might be fraudulent. Prior to September
2018, ULL did not suspend a driver’s access to his or her account while
ULL investigated and confirmed whether the driver had submitted afraudulent document which enabled the driver to continue to work andaccept bookings.
88. The ULL Board ordered a change to the way in which drivers suspectedof this type of fraud were treated in September 2018 to suspend thedrivers. However, TfL is concerned that the historic practice of ULL’s
operational teams at the time of these incidents was to allow drivers toPage 26 of 62

continue to drive. That raises questions as to the judgement of theoperational teams including whether or not they had appreciated theseriousness of this issue and whether or not passenger safety was being
treated as paramount.
89. ULL has now explained to TfL the new steps that it has taken to identify
and investigate potential fraudulent documents. They are significant,sophisticated and extensive, and are likely to lead to better results within
ULL’s systems. They include:a) Introduction of a secondary review of all documents before they areapproved;b) An increase in the number of ongoing assurance checks that areundertaken after document approval;c) Document fraud training that has been developed with the support of
the Home Office and the Metropolitan Police Service;d) Availability of reference guides for agents that include examples ofofficial documentation;e) Introduction of a feedback loop to update agent training material as
and when new fraud techniques and patterns are identified;f) Extension of the Instadoc system to additional insurance providers,enabling insurance documentation to be submitted directly to Uber by
the insurer;g) Enhancements to its document approval system, for example
functionality that will flag to an agent when a driver re-submits adocument multiple times.
90. More recently, ULL’s letter received on 21 November 2019, highlighted
that it has been in discussion with the Insurance Fraud Enforcement
Division (IFED), part of the City of London Police, to talk them throughthe steps that ULL has taken to identify and investigate potentiallyfraudulent insurance documentation and to explore the prospect ofconvening a cross-industry working group to share information and bestpractice in this area. The steps and actions taken by ULL in this area
have also been recognised by the insurance sector as being
sophisticated and thorough.
91. ULL also provides TfL with a weekly update on suspected or suspicious
fraudulent documents. The October 2019 Assurance Report records that
there was only one concluded incident between 1 June and 30

Page 27 of 62

September 2019 where a driver had uploaded a fraudulent insurance
document. It also referred to two concluded incidents that occurred prior
to 1 June 2019 but were not included in the June 2019 Assurance Reportof fraudulent insurance certificates being uploaded by the driver.
92. In conclusion, the number of cases in which fraudulent insurance
certificates (or other documents) have been accepted by ULL has fallen
and the steps ULL has taken in this regard are recognised. Nonetheless,
ULL’s recent breaches in this area were serious. This posed a significant
and unacceptable risk to passenger safety.
(b) Driver Photo Fraud Issue
93. On 14 November 2018, ULL sent to TfL a PHV105 notification
concerning a driver who had been dismissed from the Uber platform. The
notification explained that ULL had become aware that the individual
driving the vehicle was male, while the name on the account was female.
ULL investigated and removed the individual from the platform. In
subsequent correspondence about this matter, ULL has subsequently
confirmed that it did not consider this issue to be safety related and it
was not escalated to TfL in the normal way, as a safety matter, which
involves specific written notification of an issue being sent directly tosenior management in TfL’s Taxi and Private Hire (TPH) team. There
were several other PHV105 notifications of dismissals of drivers involvedin the driver photo fraud issue that were subsequently received, but the
information in those notifications were vague as discussed further inparagraph 99 below.
94. Appendix 2 to ULL’s June 2019 Assurance Report contained a table
listing 12 breaches that occurred prior to 1 December 2018, but had notbeen identified during the assurance process for the December 2018
report. The report explained that these breaches were not included in the
December Assurance Report because they were identified in theassurance process that took place during the period 1 December 2018 to
31 May 2019.
95. Six of these breaches were described as cases of “partner-driver fraud”,
specifically “partner drivers manipulated settings on their device toupload their photograph as the profile picture on another partner driver’s
account, enabling them to take trips on that account”. In five of those six
cases, the individual who manipulated settings to upload their own
picture on another driver’s account had already been dismissed from the
Uber platform. The driver whose account had been altered had also
been complicit in this fraud by providing their login details to thePage 28 of 62

unauthorised driver.
November 2018.

The breaches took place between August and96. ULL explained in the Appendix that Uber drivers in the UK are notallowed to upload a new photograph to the Uber platform, although,despite being a clear safety risk, this is possible in some other countries.
However, four of the six drivers were able to circumvent this prohibitionby manipulating GPS settings on their device, so that it appeared as
though they were out of the UK at the time. As part of the maturity
assessment carried out by Cognizant they identified that the way tomanipulate the GPS settings was quite basic It merely required the GPS
settings to be switched off. It is clear that this vulnerability should havebeen identified as a flaw by Uber in the design phase.
97. The other two cases related to exploitation of a legacy version of the app,which was replaced by a new version of the app in late 2018. The legacy
app was decommissioned in December 2018 and therefore would nothave been able to be used from that time.
98. TfL was concerned that these cases gave rise to potentially serious
safety issues, and it did not consider that ULL had adequately escalated
these cases previously. They should have been brought to the attentionof TPH’s senior management as soon as they were identified.
99. TfL has expressed the view on more than one occasion to ULL, in early
2019, that the content of ULL’s PHV105 notifications were sometimes toovague and incomplete and did not give TfL sufficient information to
enable it to consider the appropriate regulatory action to take against thedriver concerned. ULL’s position, in response, was that “in order toprotect the integrity of our fraud detection measures we are unfortunately
unable to be more specific in our PHV105 notices about the fraudulent
behaviour(s) that an individual driver might have exhibited.”
100.
This gave TfL some cause for concern, because it seemed thatULL was prioritising the protection of its fraud detection measures oversafety.
101.
For example, several notifications TfL received concerning drivers
involved in the driver photo fraud issue said that the driver “wasperforming fraudulent activity whilst using the Uber app”, and that the
behaviour was in breach of Uber’s services agreement. The notifications
also said “we are unfortunately unable to disclose anything further as thiswould reveal sensitive fraud-detection methods…” After further andlengthy discussion with ULL, it said it would improve the notifications andeventually began providing fuller and more detailed PHV 105

Page 29 of 62

notifications in July 2019, although TfL was still receiving updated
notifications into September 2019.
102.
On 14 August 2019, TfL wrote to ULL and enquired how many
trips had been undertaken by the unauthorised drivers in question after
the profile pictures had been swapped.
103.

ULL wrote to TfL on 22 August 2019 and explained that:a) It had now completed its internal audit process which had identified afurther 15 cases involving identity fraud by drivers: the total number ofcases was now 21;b) As of that date, all those additional drivers’ accounts were suspended
whilst investigations were completed.
c) Of the 15 further cases identified, two involved unknown drivers using
the accounts of ULL drivers. In other words, these were probably not
drivers that have previously been active on the ULL app and may nothave a London PHV driver’s licence at all.
104.
ULL’s email also explained the steps it was taking to preventthese issues which included:a) New functionality of the driver app (based on the ID of the city that adriver on-boarded with Uber) to restrict uploading of driver
photographs in the UK.
b) Since early 2019, all new driver photographs go through a review
process during which the profile picture is compared against thephotographs on the PHDL and the DVLA driving licence documentson the driver account.
c) Implemented functionality preventing drivers who have on-boarded
after January 2019 from uploading photographs remotely (no longer
allowing drivers to upload a photograph when they initially create an
account).
d) All driver photographs would now be taken in the Greenlight Hub.
e) Implementing a specific photograph backdrop designed to help
prevent drivers from imitating a photograph taken in the Greenlight
Hub.
105.
TfL wrote to ULL on 5 September 2019 and asked, whether the
ULL Board was aware of this issue and sought specific details about thePage 30 of 62

cases including the number of trips carried out and whether the drivers
involved were licensed by TfL at the time.
106.
In its reply on 12 September 2019, ULL explained, amongst otherthings, that:a) It fully shares TfL’s safety concerns about these incidents.
b) The time window during which drivers had been able to change theirprofile pictures was now wider than ULL originally understood asincidents had occurred between at least 12 August 2018 to 20
January 2019.
c) The original breach was miscategorised by ULL, which did not identify
it as a regulatory breach, which should have appeared in the
December Assurance Report.
d) Nine of the 15 cases that were identified in the 22 August 2019 email
could and should have been included in the June 2019 Assurance
Review.
e) While some of the cases arose out of GPS manipulation, the root
cause analysis had at that time identified that the Uber platform may
have been manipulated in more than one way.
f) Investigations were ongoing, and it had not reached a conclusion as
to the root causes of this issue.
107.
ULL’s reply included details of the number of trips taken on thecompromised driver accounts. In total, at that time, there were 13,850
trips that were affected by the driver photo fraud issue which gave TfL
cause for concern. Some of those drivers had each taken over 1,000
trips before ULL had identified any issues and suspended them. One ofthese drivers has not been identified and took 539 trips. It is possiblethat this driver has never been licensed in London as a PHV driver or
had been licensed but their licence had been revoked. It is alsosignificant to note that these trips would not have been insured.
108.
ULL also gave a lengthy explanation of the timeline for identifying
these cases and the steps it took. It referred to a complete audit which itcommenced in February 2019 of all London drivers who had taken a trip
between 1 September 2018 and 11 February 2019 (the date the audit
activity commenced) to ensure that it had accurate photos of them on
file. The initial phase of the review was completed in April 2019. A further
review was carried out by ULL’s Documents Compliance team based inPage 31 of 62

London which concluded on 22 August 2019 and ULL provided theresults of that to TfL.
109.
In terms of the overall handling of this issue, ULL had received
two passenger complaints in February and March 2019 about the driver’s
profile picture in the app not matching the picture on the driver’s PHDL
badge. Those incidents were discussed by the LOMC on 5 March 2019.
This issue was escalated to the ULL Board at the meeting on 25 March
2019. Following further discussion by the Board about this issue, as
more cases came to light, ULL notified TfL on 31 May 2019.
110.
It is not considered that the manner in which this issue wasnotified to TfL was consistent with other notifications ULL has given.
Usually, any issues of substance and concern were escalated by way of
a separate letter or email to the TPH’s senior management. However,this issue was included in a note giving an overview of ULL’s
correspondence to TfL and its key activity over the past month. This is
not considered to be appropriate notification. This is not simply aformalistic point. It indicates that ULL may not have fully appreciated thesignificance of this issue such as to highlight it properly to TfL, and seek
to discuss it further. This is further supported by the fact that these cases
appeared in an Appendix to the June 2019 Assurance Report, rather
than appearing in the body of the report. That raises questions as towhether ULL was trying to lessen the impact and significance of theseissues hoping that they would go unnoticed, or alternatively, it gives
cause to question the judgement of the senior operational management
team as to the manner in which these issues were communicated andthe importance that ULL attributed to them.
111.
It is of serious concern that the licence of one of the drivers
involved in manipulating the Uber app in this manner had earlier been
revoked by TfL because the driver accepted a caution in respect of the
distribution of indecent images of children. This raises serious safetyconcerns as this driver was accessing the Uber app, and providing
services, despite the fact that TfL (and ULL) had previously decided thatthey were no longer suitable to provide PHV services to the public. All of
the identified drivers who had swapped their profile photo onto theaccount of a ULL driver had been previously dismissed or suspended by
ULL.
112.
TfL was concerned about this issue at the time of taking its
decision to grant a licence to ULL on 24 September 2019. As set out
above, at that time, TfL did not have a full and clear picture of therelevant events and their causes. There remained questions concerning
how many unauthorised drivers, whether licensed or not, may have beenable to manipulate the app and undertake trips, as well as the complaint

Page 32 of 62

history of these drivers, and ULL was still investigating this matter andhad not identified all of the root causes.
113.
In the intervening period, TfL asked ULL to provide the complaint
history for each of the drivers involved in the driver photo fraud issue inorder to understand whether there had been any other safety related
complaints for each of these drivers. TfL was disappointed that ULL had
not previously undertaken a review of those complaints’ histories. This
has led to further concern as to whether ULL has fully understand all of
the safety implications arising from this issue.
114.
TfL attended ULL’s London office on 15 October 2019 to obtainfurther information in relation to the driver photo fraud issue directly from
ULL’s systems. As part of the visit, ULL demonstrated some of the tools
and processes it used to access and analyse the complaints history of its
drivers. TfL noted with some surprise that ULL did not have a centralised
tool to store and access relevant information. This raised doubts for TfL
as to the ease in which ULL was able to accurately and efficiently findand analyse complaints that were on a driver’s record. Consequently,
during the visit, several complaints were identified by TfL that were notincluded in previously submitted PHV105 dismissal forms due to being
either miscategorised or omitted erroneously.
115.
In one specific case, TfL also identified several complaints thatwere included within the PHV105 dismissal form it had received from
ULL that related to significant concerns about the inappropriate conduct
and identity of the driver. It is TfL’s view that ULL did not investigate
these complaints appropriately.
116.
TfL held two further meetings with ULL on 11 and 16 October
2019. In the meeting on 16 October 2019, ULL provided an update on its
audit of driver photo fraud incidents and a review of associatedcomplaints from March 2018. It also committed to providing TfL with full
information in writing by 1 November.
117.
On 22 October 2019, ULL provided further details of some of thedrivers involved in the driver photo fraud issue. This included a further
case of driver photo fraud that had been identified following a further
audit which was undertaken using a wider timeframe. It explained thatthe profile photo on an account belonging to a driver was uploaded 15
January 2019 of another driver who had been dismissed on 12 June2018 for fraudulent behaviour relating to manipulation of GPS settings on
his device. The driver who had the account and allowed the profile photo
to be altered was dismissed for fraudulent behaviour involving 4 highvalue trips on 13 April 2019. Between 15 January 2019 and 13 April
2019, there were 481 trips taken.

Page 33 of 62

118.
In the update given on 22 October 2019, ULL explained that oneof the cases that it had originally treated as being driver photo fraud (asreported to TfL in ULL’s letter of 22 August 2019) in fact involved thePrivate Hire Driver’s Licence and DVLA Driving Licence belonging to one
driver being uploaded to the account of another driver and the name on
the account changed. TfL sought clarity from ULL in relation to this issue,
in a letter sent on 13 November 2019, as there were discrepancies in thedata and information provided. This raises another issue of concern inthat it appears to be fairly easy for duplicate accounts to be created bypersons who may be unlicensed as PHV drivers or previously suspended
or dismissed. TfL is also concerned that ULL had firstly identified thisissue as driver photo fraud but then had later recategorised it. Thissuggests that ULL may be unclear about the actual nature of incidents
such as this. That calls into question the confidence that can be placed in
the accuracy of the information that ULL provides about these breaches.
119.
ULL provided further information about these two drivers on 18
November 2019, but this issue remains unclear, and in the time
available, it has not been possible to resolve it.
120.
On 25 October 2019, ULL gave full driver complaint histories of 40
drivers that it said were involved in 21 cases of driver photo fraud. There
were 40 drivers involved in these cases because the drivers whose
account had been altered were complicit in the fraud by giving access totheir account to the unauthorised person. ULL’s email of 25 October
2019 included another driver that had subsequently been identified by
ULL following a further audit it had undertaken. It also referred to 20
complaints about the drivers which were classed as “safety related
complaints” that were omitted from the PHV105 dismissal forms that TfL
received for the drivers.
Information about other safety related
complaints concerning a driver are important when TfL assesses thefitness of that driver.
121.
This lack of accuracy is of significant concern and raises
questions over the effectiveness of ULL’s complaint reporting process.
These omissions suggest that there could be several other safety related
complaints that TfL has not had sight of when reviewing a driver’s fitness
to hold a licence.
122.
ULL’s General Manager for UK and Ireland also wrote to TfL on
25 October 2019 providing a summary of the issue and actions it has
taken with regard to driver photo fraud issue. The letter explained that:a) The first technical vulnerability was that GPS settings on a mobile
device could be manipulated to enable an individual to bypass thePage 34 of 62

security settings in the Uber app, which prevent drivers in the UKfrom uploading or amending profile pictures. This was triggered by aglobal technical change introduced by Uber on 7 March 2018 to allow
drivers to remotely upload their photograph in the driver app, which isavailable to some countries in which Uber operates.
b) The second technical vulnerability was caused by a global change
made on 15 October 2018 when Uber introduced a technical change
to classify a driver’s profile picture as a ‘required document’ on thedriver’s account rather than a simple ‘photograph’, and as such adriver was able to upload a profile picture to their account. A legacy
version of the Uber app enabled drivers to remotely upload a profile
photo.
123.
ULL also identified additional steps it had taken to prevent thisissue reoccurring:a) Introduction of a technical change so that only photographs takenusing the internal Uber Driver Photo App on an Uber-owned device
can be uploaded to a driver’s account. This applies to all photographs
uploaded from 11 October 2019 onwards. Driver photos uploaded
before 11 October 2019 have been reviewed by ULL.
b) Implementation of a further technical change within ‘Enforcer’, ULL’s
compliance system used in real-time when dispatching bookings todrivers and vehicles. The Enforcer system now includes an additional
check to confirm that the profile picture on a driver’s account has
successfully passed the most recent audit or was taken using the
Uber Driver Photo App and approved by ULL before confirming theeligibility of that driver to complete the booking. This change was also
implemented on 11 October 2019.
124.
ULL wrote again to TfL on 5 November 2019 about another issue
that TfL wanted further information about involving the wrong drivers
undertaking trips. It said in this letter that in the course of investigating
the wrong driver complaints received, it had identified one further
instance of driver photo fraud. ULL explained that during a recent audit,
this case was identified as a potential mismatch between profile pictureand driver documents, but the agent concluded the pictures were amatch. Following reassessment as part of the wrong driver review, thecase was escalated to ULL’s senior management which concluded thiswas a case of driver photo fraud. ULL gave details of the case. The
profile photo on the account belonging to a driver was uploaded on 1
December 2018 of another driver who had been dismissed on 25
November 2018 for fraudulent behaviour relating to cancellation fees.
There were 334 trips were taken on the account between 1 DecemberPage 35 of 622018 and 18 February 2019 when the account was suspended as thedriver’s PHV driver’s licence had expired.
125.
The precise scope of the driver photo fraud issue has evolved
over time. ULL’s letter of 25 October says that, as at 22 August 2019, afurther 20 cases of driver photo fraud had been identified. However, thisappears to contradict the letter of 22 August 2019, which refers to afurther 15 cases having been identified during ULL’s audit.
126.
More importantly, the letter of 22 August 2019 said that ULL’s
audit was complete, and that ULL was confident that there were no more
drivers involved. Following the September 2019 decision, however, ULL
said it carried out a further audit, which reviewed cases from 7 March2018 (this was the date that ULL said its exposure to vulnerability ofdriver photo fraud first began), and found another driver that had been
involved in driver photo fraud (see above). Then on 5 November 2019,
ULL explained that it had found another driver photo fraud case when
undertaking a review concerning complaints about the wrong driverundertaking the trip (see above).
127.
TfL is concerned that it has undertaken a number of internal
reviews within different time parameters and each time has found more
drivers who have been involved in the driver photo fraud issue. ULL’s
approach to and handling of this issue does not give confidence in: (a)the outcome of the latest review, (b) the fact that all drivers involved havebeen identified and that the number of trips have been identified, and (c)that ULL has a clear grasp of all of the relevant issues.
128.
TfL has reviewed the complaints history that ULL has now
provided to TfL for all the drivers involved in this issue. However, as
noted above, it is not possible to confidently state that complaints havebeen correctly categorised and that there are not more drivers involved inthis issue that have not been identified by ULL. It is noted that one of thedrivers accepted a caution for downloading and distributing an indecent
image of a child and his PHV driver’s licence had been revoked by TfL.
This is clearly alarming as the individual in question had been allocatedover 1,500 trips by ULL, creating a significant public safety risk.
129.
TfL recognises the steps that ULL has put in place in order toprevent this type of fraud reoccurring. Further, on 24 November 2019,
ULL provided TfL with notification of a material change to the Uber app
by introducing Real-Time ID Check in the Driver app in the UK and
Ireland. It explained that Real-Time ID Check is designed to further
minimise any possibility for drivers to fraudulently participate inunauthorised account-sharing. When triggered, Real-Time ID Checkinvolves comparing the driver’s profile picture (which has previously been

Page 36 of 62

verified against their ID Document) with a real-time driver selfie. The
driver will only be able to go online if it is determined that the faces inthese two photos match. Explicit consent to this will need to be given by
the drivers in order to comply with the GDPR. The drivers can choose
between either having the picture reviewed via Microsoft identity
verification technology or by having three Uber agents independently
review the submission manually. If the driver does not agree to either ofthese options, they will not be permitted to go online.
130.
ULL explained that the Microsoft product incorporates selfie
quality filters which help drivers submit compliant selfies, including theface being clear, the photo having enough lighting, no blurring, or theuser wearing glasses. It said that although the manual review does not
currently have this feature, it is working on developing this technology forany driver selfies submitted through this option and expects to have this
implemented into the product in the first half of 2020.
131.
ULL said that the feature will be triggered in a number ofcircumstances:a) in response to Uber receiving a "wrong driver" type passenger
complaint;b) randomly but regularly triggered before a driver goes online,.
132.
ULL gave details on how Real-Time ID Check will work in practice.
It confirmed that drivers who fail for the first time will be held offline for 24hours, after which time they will be able to submit a new selfie, anddrivers will not be able to go online until a selfie has been approved. A
second failure at any point in the future results in dismissal.
133.
ULL said that it intends to roll out this feature imminently, pending
the approval of the Data Protection Impact Assessment, as required by
GDPR, by Uber’s Chief Privacy Officer and Data Protection Officer. It
confirmed that LOMC had considered the change and concluded that
notification needed to be given to TfL in accordance with its conditions.
Due to the date on which this notification was received, it has not beenpossible to fully consider this proposed change to the Uber driver app. In
principle, taking action to prevent drivers fraudulently participating inunauthorised account-sharing is welcomed and demonstrates Uber’scommitments to preventing such issues occurring in the future. It is also
acknowledged that this is likely to be an industry first in London. For thereasons set out below, TfL expects ULL to fully consider any
vulnerabilities that may inadvertently be created as a result of the Real-Page 37 of 62

Time ID check feature and ensure that it is introduced with appropriate
due diligence and controls. The proposed change has been taken into
account in our decision.
134.
However, In addition, it is of concern that ULL’s systems seem tohave been comparatively easily manipulated such that drivers were able
to change photos on driver profiles on the Uber app. At least 14,000 trips
were undertaken by drivers who were not authorised to do so. Thissignificantly compromises the safety of passengers, not only becausesome of the drivers involved had previously been dismissed (and may
have committed criminal offences), but also because all of those
thousands of trips would not have been insured. It appears that this fraud
has been able to take place due to the way in which Uber’s technicalsystems operate both in London and globally. In addition, TfL cannot be
confident that there are not any other cases of driver photo fraud andthat all necessary steps have been taken to prevent it happening again.
135.
TfL considers this to be a particularly serious breach of thelicensing regime and one of the most significant breaches by ULL todate.
(c) Other regulatory breaches
136.
ULL’s Assurance Reports include details of regulatory breaches
that have occurred in each relevant period, including the root cause andULL’s action plan to ensure that they do not happen again.
137.
The December 2018 report recorded 152 regulatory breaches that
occurred during the period 26 June to 30 November 2018. The 152
breaches in total were:a) 47 breaches which included the breach of the condition 12b duty to
notify any decision to suspend or remove a driver from the platform
within 48 hours;b) 85 breaches of Regulation 9(4)(c) obligation to notify all driver
removals from the platform within 14 days;c) 5 breaches of insurance obligations;d) 7 bookings carried out by vehicles without valid PHV licences or valid
insurance certificates;e) 1 case of a driver driving with a disqualified DVLA licence.

Page 38 of 62

138.
Although they did not appear in the December 2018 Assurance
Report, during the period between 1 January 2018 and 30 November
2018, there were also a further 23 cases of fraudulent documentation
provided to, and approved by, ULL.
139.
The June 2019 report recorded 50 regulatory breaches as having
taken place in the period between 1 December 2018 and 31 May 2019.
They were:a) 25 breaches of condition 12(b);b) 2 breaches of regulation 9(4)(c);c) 8 breaches of the obligation to ensure that bookings are accurate andcomplete;d) 7 breaches of the obligation to ensure that vehicle records areaccurate and up to date (2 of which were driver fraud involving MOTor PHV licences discussed further below);e) 2 breaches of the obligation to ensure that driver records are up to
date;f) 4 breaches of obligation to ensure that ULL holds records of current
certificates of insurance for each vehicle operated;g) 1 breach of the obligation to ensure that bookings accepted by ULL
are allocated and carried out by TfL-licensed vehicles and drivers;andh) 1 breach of the obligation to ensure that ULL provides accurate
information to passengers about the driver and vehicle assigned totheir booking.
140.
The June 2019 report also provided detailed analysis of the 23
cases of fraudulent documentation provided that had been approved by
ULL between 1 January 2018 and 30 November 2018 broken down bybreach category. These 23 cases included:a) 2 incidents where a driver uploaded a fraudulent private hire driver
licence and trips were dispatched to the driver whilst that document
was active on the driver’s account.
b) 2 incidents where a driver uploaded a fraudulent vehicle document(MOT certificate or private hire vehicle licence) and trips werePage 39 of 62

dispatched to the vehicle whilst that document was active on thedriver’s account.
c) 19 incidents where a driver uploaded a fraudulent insurance
document and trips have been dispatched to the vehicle whilst that
document was active on the driver’s account.
141.
The June 2019 report referred, in detail, to Programme ZERO anddemonstrated the positive impact of it in a chart showing that breaches ofcondition (other than condition 12b) had reduced from 38 in the firstquarter of 2018 to 14 in the first quarter of 2019, and to 3 in the first twomonths of the second quarter of 2019. It also referred to a gradualreduction of breaches of condition 12b since 1 January 2019.
142.
Despite the positive downward trend ULL has demonstrated in thereport, TfL has found 4 breaches that occurred within the date range of
the June 2019 report that were not included in that report. ULL were
informed of these breaches and confirmed their validity, including them in
the October report.
143.
Another area that causes some concern is a discrepancy with thetimestamp data on driver suspension notices. TfL has discovered
several examples where ULL appeared to have taken action against adriver, before the incident is alleged to have occurred. When TfL queried
this with ULL, they advised that this was caused by human error whenrecording the incident details. Given that there have been several otherdiscrepancies with the data provided from ULL, for example instanceswhere licence numbers or names have been incorrect, and the relatively
small window of time applied to condition 12(b), it is possible that there
are other breaches that have been inaccurately recorded and havetherefore gone unreported/unnoticed by ULL.
144.
The October 2019 report identified 24 regulatory breaches that
occurred between 1 June to 30 September 2019. They were:a) 17 breaches of condition 12(b);b) 1 breach of both conditions 16 and 19;c) 1 breach of the obligation to keep booking records accurate andcomplete;d) 2 breaches of the obligation to appropriately action and respond to all
vehicle suspension requests;

Page 40 of 62e) 2 breaches of the obligation that ULL holds records of current
certificates of insurance for each vehicle it operates;f) 1 breach of the obligation to ensure all driver records are accurate
and up to date.
145.
The October 2019 report also identified 27 regulatory breaches
that occurred prior to 1 June 2019 but were not included in the June2019 Assurance Report. These breaches were:a) 4 breaches of condition 12b (in all of these cases, reports were
eventually made to TfL but a significant period of time had passed
since the complaint was received; in one case, it was 147 days);b) 2 breaches of conditions 16 and 19 where a driver uploaded afraudulent insurance certificate and trips were dispatched to thevehicle whilst that document was active on the driver’s account;c) 8 incidents where insurance
prematurely approved;

certificateswere

correctly

butd) 13 incidents of driver photo fraud where an account profile picture
was replaced with the image of a different individual and trips weretaken.
146.
TfL requested the raw data that supported the preparation of theJune 2019 Assurance Report in order to verify the basis of theinformation that ULL was relying upon in that Report. Following a reviewof this information, TfL identified a further four breaches of condition 12bthat are not included among the 27 incidents referred to above but
occurred prior to 1 June 2019.
147.
Further to this, TfL identified one additional breach that was
included in the October 2019 Assurance Report but in respect of which
TfL had not received any prior notification. TfL queried this with ULL on
21 November 2019. ULL confirmed that, due to a system or human error,
there were seven notifications that had not been sent to TfL. Having
received these cases, TfL immediately reviewed them and found that a
number related to serious criminal allegations including, for example, anallegation of rape and other sexual assaults. This system error highlights
the importance of complying with condition 12b which is in place toensure that TfL is informed promptly on any safety related incidents
involving a licensed PHV driver, so that it can make an immediate
assessment to determine whether any licensing action is required. At themost basic level, even if the relevant individual is removed from the ULL
platform, if TfL does not know about the incident they could continue
providing PHV services via another platform or app.

Page 41 of 62148.
As this issue came to TfL’s attention on 21 November 2019, theseseven cases are still being investigated by TfL and appropriate licensing
action will urgently be taken. It is also vital that ULL conducts a thoroughand urgent audit of all notifications sent to TfL, whether they were sent
within or outside the required 48 hour notification period, in order todetermine whether further errors have resulted in notifications not being
sent to or received by TfL. This is clearly a matter of significant urgency
and concern if drivers are continuing to provide PHV services for ULL or
any other operator despite an ongoing and live police investigation. Thislatest incident also raises concerns with the effectiveness of ULL’s
reporting systems.
149.
It is of concern is that the assurance processes for December
2018 and June 2019 did not identify all regulatory breaches, even though
they occurred during the relevant periods for each report, and there is noclear understanding to TfL as to why they were not identified andreported. Although the June 2019 Assurance Report points to the
reduction in regulatory breaches since Programme ZERO has been
introduced, the inconsistency in reporting of the number of regulatory
breaches between each of the Assurance Reports makes it difficult totrust the accuracy of the data being shared and to have a clear picture ofwhether there have been improvements.
150.
It is also of concern that there continues to be breaches ofcondition 12b even though the Board’s Programme ZERO has a specificWorkstream to eliminate such breaches, and has made a number of
improvements in this area. This condition is particularly important toensure the safety of passengers and therefore it is worrying thatbreaches continue to occur, albeit they have reduced.
151.
In the December 2018 and June 2019 Assurance Reports, as wellas in subsequent correspondence, ULL set out the steps it was taking toensure that such breaches did not occur and yet, it is apparent from theOctober 2019 report, that these changes have not been fully effective. A
failure on ULL’s part to dismiss drivers within the relevant time frame, or
to notify that decision to TfL, raises real safety concerns for TfL. When
incidents of this kind occur, it is essential that drivers are prevented fromproviding PHV services as soon as possible.
152.
It is true that the number of regulatory breaches over the period
between 1 January 2018 to 30 September 2019 has decreased.
However, there continue to be an unacceptable number of breaches andULL’s failure to eliminate these is of serious concern.

Page 42 of 62

153.
ULL has said that it received 27,799 safety-related complaints outof 597,881 complaints between 1 December 2018 and 31 May 2019, itsays that this should be seen against the backdrop of the total number oftrips taken (trips between 1 December 2018 and 31 May
2019). However, even if the number of safety complaints is statisticallysmall (when viewed against the total number of trips), the risks to the
public arising out of unsafe driver conduct are significant. In its October
2019 Assurance Report, ULL said that it investigated 15,937 potential
safety related complaints from passengers, of which 1,521 wereclassified as potential serious safety incidents. Of those cases, 1,113
met ULL’s criteria for reporting to TfL and only 17 of those cases were
not reported to TfL within 48 hours, constituting a 99.89333% compliance
rate. Whilst it is recognised that the non-compliance rate is small byreference to ULL’s size as a whole, the absolute number of incidents,17,
is not small.
154.
Overall, it is disappointing and of concern that any breaches ofany kind have occurred since the Chief Magistrate granted ULL a licencein June 2018.
155.
As set out above, the ULL Board is seeking to eliminate further
breaches through Programme ZERO and details the work it has done in
the October 2019 Assurance Report. TfL recognises that ULL has madechanges to ensure that regulatory compliance is at the forefront of its
operations.
156.
However, the fact that there have been a significant number ofregulatory breaches in the period since the Chief Magistrate granted ULL
a licence, does not suggest that the changes made by senior
management have been fully embedded within ULL, or fully successful inachieving their goal.
157.
In addition, the fact that TfL has identified further breaches, andhas had to request the data supporting both of the December 2018 andJune 2019 reports, does not offer confidence that the changes being put
in place by the ULL Board will successfully reduce the number andoccurrence of regulatory breaches to a zero (or de minimis) level. This isconcerning, because many of these breaches are safety-related andcould put passengers at risk.
158.
Together with the matters set out above, the scale andseriousness of the breaches in question cast doubt on ULL’s fitness andpropriety to hold a PHV operator’s licence.
(b) ULL’s Assurance Reports

Page 43 of 62

159.
As described above, one of the conditions imposed by the Chief
Magistrate on ULL’s licence was that it should provide biannual
Assurance Reports to TfL. The function of those reports, at least in part,is to provide TfL with an overview of ULL’s systems and their operation in
the past six months. That provides TfL with visibility in relation to any
breaches of the licensing framework and assurance and confidence as tothe fitness and propriety of ULL.
160.
There has been an iterative process in terms of the quality andtransparency of those reports. The December 2018 report was difficult toread because information about each of the regulatory breaches are
spread across several pages in table form. The report was incomplete as
it did not refer to the drivers involving the lack of insurance, and did notoffer a critical review of ULL’s performance.
161.
TfL set out its views about the December 2018 Assurance Report
to ULL in a letter dated 30 April 2019 and suggested a number of mattersthat should be addressed in the next report. The June 2019 Assurance
Report reflected many of those changes and provided more usefulmaterial in a more accessible format. Nonetheless, TfL still did not findthe June 2019 report easy to interpret. Issues listed in the report are split
into several sections and the number of incidents is not easy to correlate
to the individual driver dismissal notifications that are sent to TfL as andwhen they occur. TfL has, as a result, now had to request a single
spreadsheet from ULL listing all the incidents detailed in various sectionsof the June 2019 report so it can cross check these against individual
reports provided to TfL (when a driver is dismissed).
162.
Although the October 2019 Assurance Report is easier to readand more concise, there are a number of breaches that occurred
between 1 December 2018 and 31 May 2019 but were not identified by
the assurance process adopted for the June 2019 Assurance Report.
163.
There are three features of the ULL Assurance Reports that cause
TfL some concern. First, as set out above, the June 2019 Assurance
Report included a number of extremely serious breaches relating todriver photo fraud in Appendix 2, as discussed above. The presentationof this critical issue in an Appendix to the report caused real concern,
because it indicated that ULL either did not appreciate the seriousness ofthe breaches or (less likely) was seeking to minimise their significance.
This is not a cosmetic point about presentation, but rather a serious issue
as to whether or not ULL appreciates the nature of its obligations as a
PHV operator and is able to identify a serious breach of the licensing
framework which places customers at risk.

Page 44 of 62

164.
Second, as set out above, the June and October 2019 Assurance
Reports have provided information concerning breaches in the period
covered by the prior report. In practical terms, the December 2018 andJune 2019 Assurance Reports have had to be subsequently updated in
the light of new material showing that there were additional breaches ofthe licensing regime not identified at the time. It is recognised that, atleast in principle, it is the nature of some breaches that they are not
identified at the time. However, it is of concern that there is such a strong
pattern of retrospective identification and reporting of breaches by ULL.
This undermines any confidence that could be placed on the reliability of
ULL’s systems and in ULL’s ability to identify and address breaches
rapidly. In addition, it questions the confidence that can be placed on the
October 2019 report having fully captured all breaches that occurred
during the relevant period.
165.
Third, as set out above, it is of concern that due to the lack of acentralised tool to store and access relevant information about drivers’
complaint histories, as observed during TfL’s visit to ULL’s London office,
ULL is unable to accurately find and analyse complaints on a driver’s
record and to categorise them appropriately on every occasion that it
might need to.
166.
Taken together with the matters set out above, these issues givecause to question the confidence that can be placed in ULL fully
identifying issues of relevance in the Assurance Reports. TfL has had torequest the raw data to support the June 2018 Assurance Report so as
to satisfy itself as to the accuracy of the information included in it.
167.
The commitment and resources that ULL has put into producing
the Assurance Reports is recognised. However, these Reports have notprovided the level of assurance necessary concerning ULL’s ability toidentify incidents, recognise their importance and address them rapidly.
This reinforces the conclusions, set out elsewhere in this Note, that TfL
lacks confidence in the reliability of ULL’s systems and in ULL’s ability toprevent significant breaches occurring in the future.
(c) TfL’s attempt to obtain confidence about ULL’s systems: the Cognizant
reports
168.
At the time of the decision on 24 September 2019, TfL had anumber of concerns about the extent to which Uber’s systems arevulnerable to manipulation by drivers or other third parties, as discussed
above. Since the Chief Magistrate granted a licence to ULL in June
2018, in addition to the driver photo fraud issue and document fraudissues described above, TfL has received notifications from ULL of a

Page 45 of 62

number of instances in which drivers had been able to manipulate theUber app or change it in some way, conferring on them some kind of
improper advantage and potentially causing a risk to public safety.
These notifications included:a) An unauthorised software patch (available on iPhones) by which
drivers could see passenger destinations and select them on thatbasis (which, at the time, was not available to drivers before the trip
had commenced). This patch was mainly used by drivers at airports.
Although this came to ULL’s attention in October 2017 and more was
known about this issue by February/March 2018, there was no
notification of this issue to TfL until TfL specifically asked ULL about it
in July 2018 after it was brought to TfL’s attention by a third party. By
4 June 2018, 750 drivers appeared to have early access todestination information in connection with at least one trip.
b) Manipulation and tampering of the location settings on a device whichenabled drivers to fake their location at airports has arisen in many
forms over the past 15 months. ULL notified TfL on 18 September
2018 of a new process to prevent tampering with the app (for the
purpose of jumping airport queues or finding out destinations before
the trip has begun). That process is termed the use of post online
blockers.
c) Creation of duplicate accounts by suspended or dismissed drivers.
On 20 August 2018, ULL informed TfL of six cases where drivers who
had been dismissed from ULL were able to take further trips on theapp (the total number of trips that ULL told us had been taken by thedrivers was 36). A flaw in ULL’s systems relating to a data lag that did
not allow the system to carry out the necessary compliance checks
on drivers, allowing dismissed drivers to create duplicate accounts
under different names was identified as the cause. A further exampleof this behaviour was referred to in ULL’s email to TfL about the driver
photo fraud issue dated 25 October 2019 – see above.
d) Bookings allocated to a PHV vehicle that had an expired licence andanother vehicle that had been suspended by TfL were brought to
TfL’s attention by ULL on 9 November 2018, and a further incident
involving an expired insurance certificate. ULL stated that the issues
were caused by a software bug following the rollout of its new driverapp. Although there were a number of other processes and controlsthat were not in place allowing these issues to arise and those at c)above, they are related to the apparent ease with which drivers areable to manipulate Uber’s systems. TfL acknowledges that several
steps were taken by ULL to prevent this from happening again, butPage 46 of 62

considers that there were systemic weaknesses within ULL’s systems
that enabled this to occur.
e) A YouTube video – on 14 November 2018, ULL shared a YouTube
video with TfL where the speaker explains how an Uber driver canfake their location into an airport.
169.
ULL had also drawn TfL’s attention to attempts to compromise
ULL’s cyber security which included:a) Driver Waybills - potential breach of personal data that occurred on
30 August 2018 following the roll out of a new security feature acrossUber globally which was designed to deny unauthorised login
requests and was to be the first level of defence against massive‘brute force’ tools; the new feature did not function properly, and as aresult, Uber’s second layer of defence against these types of attacks,
two factor authentication, was not triggered. During this time, accountlogins were made by what appeared to be a bot or bots. ULL’s
investigation found that access to a driver’s “Waybill” occurred. A“Waybill” provides information about a driver and the driver’s mostrecent trip, including, in some instances, the driver’s licence number.
However, ULL was not able to clarify whether accesses to the Waybill
were unauthorised.
170.
In light of these incidents, TfL concluded that during the twomonth licence period it should carry out a review of the maturity of ULL’s
systems and its cyber security in order to better understand the controls
and processes that ULL had in place. By taking this step, TfL sought toobtain assurance that the problems identified above would not recur. TfL
recognised that ULL is a large operator and that the number of incidents
described above were small by reference to the overall number ofjourneys completed by ULL. However, some of the issues describedabove are of the utmost seriousness and raise real public safetyconcerns for TfL.
171.
More recently on 6 November 2019, ULL notified TfL of a global
phishing scam targeting drivers using the Uber app. ULL explained that
one of types of fraudulent activity carried out once the driver’s accountinformation is obtained is to fraudulently manipulate their device’s GPS
signals, allowing it to start a trip and create a fictitious journey for which
the passenger is then charged. ULL explained the work it was doing toaddress this but it further highlights the ease with which fraudsters
appear to be able to manipulate the Uber app.
172.
TfL already had some understanding of ULL’s change
management and product development processes. In both of its 2019

Page 47 of 62

licence applications, ULL referred to the requirement that any proposedchanges to the app are communicated through a Product Review
Document (“PRD”), which is provided to relevant stakeholders, prior toany product or feature being developed. PRDs must be reviewed by
Product Counsel, Privacy Counsel, local Regulatory Counsel andSupport and other reviewers, which ULL says ensures that crossfunctional partners are brought into the product development cycle early.
ULL’s Product Experience team based in London manages the roll-out of
products and features in the UK, which might impact ULL’s regulatory
obligations, and acts as the interface between Uber product andengineering teams based in San Francisco (UTI), central teams in
Amsterdam (Uber BV) and the local team (ULL). If a PRD is consideredappropriate for London and assessed to be material, it is managed
through ULL’s Product, Policy and Process and Change Management
policy which requires ULL teams to complete a Change Approval
Document along with a draft notification to TfL summarising the change
and potential risks, especially potential risks that relate to Condition 5 aswell as the wider 1998 Act.
173.
TfL’s July 2019 licence application explained that, when the
product or feature is ready for launch, the Product Experience team
based in London will prepare a UK launch strategy and gives notification
to TfL in accordance with condition 5. After the product or feature islaunched, ULL closely monitors it for 2 months to ensure it is working as
intended and is not causing unforeseen impacts. ULL said that it has
conducted training to ensure the process it has adopted for materialchanges is followed and ensure new staff are aware of it. The process
has also been shared with senior personnel in the wider Uber group who
are responsible for product development.
174.
ULL has also provided TfL with information about its software
release management process which is used for new versions of the“RiderApp” and “DriverApp”. The process involves a sequence of checks
and steps involving multiple teams before new software is put into
production.
175.
In its June 2019 assurance report, ULL referred to the Uber
London Governance and Policy Framework which sets out the policies,
processes, governing bodies and assurance activities ULL has in place
to support good governance and “specifically to adhere to thecompliance requirements associated with holding an operator’s Licence”.
The report also referred to the Compliance Working Group which was set
up in July 2018 and oversees:a) planned and unplanned changes to the App and Uber products
offered in the UK;Page 48 of 62b) any proposed act, omission or conduct which could have implications
for ULL’s PHV responsibilities;c) any change or event or any fact, matter of circumstance that ULL
considers is reasonably likely to have an adverse impact oncompliance with its PHV responsibilities.
176.
These processes, and ULL’s explanations of them, are important.
However, TfL considered that it lacked sufficient expertise, on its own,
adequately to assess whether or not ULL’s systems and processes wereappropriate for a company in its position. TfL notified ULL at a meeting
held with ULL shortly after the decision to grant a licence of two months
that it proposed to appoint an independent company to undertake areview of ULL’s systems. TfL also shared the Terms of Reference for thetechnical review with ULL and all parties met to discuss next steps.
177.
On 3 October 2019, TfL instructed Cognizant to carry out amaturity assessment and cyber security review of ULL’s systems.
Cognizant is a leading professional services company, with recognised
expertise in cyber security and systems management. TfL asked
Cognizant to:a) Assess the maturity of ULL’s Change, Release, Incident and Problem
management processes and for each of these service elements,
there will be a documented process and evidence available showing:i.

how each service element is performed;ii.

how impact and risk is assessed; andiii.

that processes exist to reverse changes that are unsuccessful.

178.
Assess the maturity of ULL’s information security control
framework by looking for adherence against relevant Cyber Security
Control Policies, with consideration towards the ISO/IEC 27001
Framework, the Cyber Essentials Scheme or HM Government
Information Security Assurance Standards to understand ULL’s current
cyber security position.
179.
TfL also provided Cognizant with a number of emails from ULL
identifying the types of manipulations that had occurred since June 2018.
180.
Cognizant completed its reports – the IT Service Management
Report and the Security Maturity Assessment on 15 November 2019.
The conclusions of the Cognizant Security Maturity Assessment werePage 49 of 62

positive, and demonstrated that ULL was at or above the level of
performance and reliability that would be expected of a company in its
position.
181.
Cognizant assigned Uber and ULL a maturity level between 0-5. A
maturity level of 0 (incomplete) indicates the activity is not performed. It’s
conclusions were:a) Uber was rated Level 3 (Managed) for Vulnerability Management
which means that Uber performs Vulnerability Management
processes in a planned manner and has sufficient resources tosupport and manage it. Cognizant expected a global service provider
like Uber to be at process maturity score of at least 3, and observedthat Uber’s Vulnerability Management process meets the
expectations.
b) Uber was rated Level 4 (Measured) for Network Security, whichmeans that Uber performs Network Security checks in a planned
manner and manages and monitors the outcomes. Cognizant
expected a global service provider like Uber to be at process maturity
score of at least 3, and observed that Uber’s Network Security
Management process exceeds the expectations.
c) Uber was rated Level 3 (Managed) for Cybersecurity Risk
Management, which means that Uber performs Cybersecurity Risk
Management processes in a planned manner and has sufficient
resources to support and manage them. However, Cognizant
expected a global service provider like Uber to be at process maturity
score of at least 4, and observed that Uber’s Cybersecurity Risk
Management process falls short of expectations.
d) Uber was rated Level 4 (Measured) for Security IncidentManagement, which means that Uber performs Security IncidentManagement processes, in a planned manner, manages andmonitors the outcomes. Cognizant expected a global service provider
like Uber to be at process maturity score of at least 3, and observedthat Uber’s Cybersecurity Risk Management process exceeds the
expectations.
182.
The Security Maturity Report identified a number of strengths andweaknesses within ULL’s systems. However, the overall outcome wasthat this report provided TfL with sufficient confidence that ULL has
adequate systems in place in relation to vulnerability management,
network security, cybersecurity and serious incident management.

Page 50 of 62

183.
The second Cognizant Report, the IT Service Management
Report, did not provide TfL with the same level of confidence:a) It assessed ULL’s Change Management systems at Level 2(Awareness), whereas it expected a global service provider like Uberto be at a process maturity score of 3.
b) It assessed Uber’s Release Management (the planning, design, build,configuration and testing of applications and services) at level 2,
whereas it expected Uber’s systems to be at level 3.
c) It assessed Uber’s Incident and Problem Management performanceat level 3; consistent with Cognizant’s expectation for a company in
Uber’s position.
184.
In relation to ULL’s Change Management systems, Cognizant
observed the following major gaps in the existing change process:a) Change tracking controls with regard to London were immature: it said
that global change is tracked using Google Sheets which has audit
history but industry best practice is to use tools with individual access
control to prevent status change by error.
b) The LOMC, responsible for approving changes for London, hasdependency on Uber’s Global engineering team to provide technicalassistance while assessing change with regard to London regulations.
c) Although change prioritisation with regard to regulatory requirements are
given high priority by the local operation team to sustain risk manually,
permanent technical change fixes are often observed as low priority.
d) The design review process is immature. For example, suspended
vehicles were able to take bookings and drivers were able to change
photographs after disabling GPS as a result of an inefficient design
review process.
185.
Cognizant said that these process gaps can have severe
consequences, such as:
186.
In relation to Release Management, Cognizant said that it
observed well-established procedures to make technical product relatedchanges and releases, extensive product testing was observed in a nonproduction environment, Beta testing focused on product stability largelyin the US. However, Cognizant observed the following major gaps in theexisting release process:Page 51 of 62a) Ad hoc and minimum testing done by the local operations teamwhile enabling any feature for London users. Informal
communication channels to confirm test success over email. No
detailing of test scenarios considered was observed.
b) Cognizant could not establish defined roles and responsibilities forrelease management especially between the release manager
and London Operation team. The Global Engineering team has
minimal involvement while any new feature is configured for
London area. Dependencies between changes are managed byproduct owners rather than release managers. The releasemanager does not have visibility of functional changes going in therelease.
c) Cognizant expected Uber to enable Forced upgrade of their app
on a regular basis to ensure drivers and passengers are on latest
app version and any vulnerabilities available in previous versions
are not exploited by users. However, no objective guidelines
existed to enforce Force upgrade; it is decided on a case-to-casebasis. An objective framework that includes nature of change andimpact of change as criteria should be defined.
187.
Cognizant said that these process gaps can have severe
consequences, such as breaking existing London specific configuration
while introducing new features and the London Operations Team may
not get adequate support from release management and any London
specific feature might be delayed/ dropped.
188.
In relation to Incident & Problem Management, althoughCognizant scored the Uber process at Level 3 (which is the level that
Cognizant expected ULL to achieve), Cognizant observed the following
gaps in the existing incident & problem management process:a) It is difficult to differentiate between incidents and user service
requests.
b) Global processes were allowed to override local processes andaccess, e.g. a team other than London Regulatory was allowed toreactivate Suspended Vehicles. Cognizant observed that access
restriction was later implemented for reactivating Suspended Vehicles
but concluded that there is a risk of similar process vulnerability
existing across other process area.
c) Multiple disjointed tools are used by different teams making it
challenging to trace end-to-end incident lifecycle

Page 52 of 62

189.
Cognizant said that these process gaps can have severe
consequences, such as:a) Lack of major incident management definition can result in delay inescalated to technical teams and timely resolution.
b) Lack of traceability across incidents will add additional time toinvestigate any high priority incident.
c) Access to sensitive features, if available to a non-relevant team, canincrease risk of regulatory and safety incidents.
190.
As described above, TfL also observed some difficulties as aresult of multiple disjointed tools when it visited ULL’s London offices on
15 October 2019. TfL notes that it does not have the same level ofexpertise as Cognizant, in this area, and it considers its own
observations to be merely confirmatory of what Cognizant has found.
191.
TfL shared the final version of the Cognizant reports with ULL on
15 November 2019 and invited ULL to comment and to identify any
points it considered to be inaccurate. ULL responded on 19 November
2019 setting out a number of points.
192.
ULL said that it was confident that the areas for development
identified by Cognizant have not and do not directly pose a risk to public
safety, but as part of its commitment to continuous improvement,
recognises that there are areas identified by Cognizant where its
processes and systems could be further strengthened. It gave examplesof the steps it would take to address these, and in some cases, havealready taken.
These steps included introducing a UK-specificRegression Test Suite to ensure that existing product functionality has
not been inadvertently degraded by a technology release and that new
products or changes to existing products do not adversely affect existing
functionality and the testing will be carried out by technical analysts
focused on the UK; that Regression Test Reports are reviewed by LOMC
prior to any product launch; the implementation of an enterprise-wide
Governance, Risk Management and Compliance (GRC) solution called‘Servicenow’, and the first module, Issue Management, is targeted to golive in January 2020, followed by subsequent modules, including
Compliance Management and Risk Management, later in the year; theexpansion of the scope of ULL’s current ISO27001 certification to include
passenger and driver systems.
193.
ULL also identified what it considered to be a number of
inaccuracies in the report, and attached a spreadsheet detailing the
inaccuracies and misinterpretations which ULL considered to be materialPage 53 of 62

across the Release Management, Change Management and Cyber Risk
sections, together with specific evidence for its position. In its letter, ULL
gave examples of the inaccuracies in the Release Management
workstream because it believed these inaccuracies had the mostsignificant impact on the maturity score that Cognizant attributed to theprocesses. These included:a) Risk and Deviation Management: Cognizant recommends (see ITSM
Assessment Report - page 10) that London-specific regulatory
requirements should be embedded (or embedded more deeply) as
part of the product development lifecycle. ULL said that it discussed
and demonstrated in several sessions that London-specific regulatory
requirements are already a part of the Product Development Lifecycle
via a notification to LOMC.
b) Change Prioritisation: ULL did not accept Cognizant conclusion thatpermanent technical change fixes are often observed as low priority,
and referred to Programme ZERO which involves close collaboration
between the ULL and San Francisco teams to prioritise the technicalchanges considered most important to the reduction of regulatory risk
for ULL, which were then delivered over the course of 2019. It said
that the 71% reduction in breaches since Q1 2019 (when ProgrammeZERO was initiated) demonstrates the effectiveness of this approach.
194.
ULL said that a further review of the Release Management
workstream taking account the points it had made would result in a Level
3 rather than a Level 2. ULL also stated that:a) It considers Cognizant’s review to have been undertaken within an
unusually compressed time frame, which it considers has contributed
to what it believes are specific factual inaccuracies and appears also
to have led, in ULL’s view, to a number of incorrect conclusions
across the report.
b) It could demonstrate that ULL has strong and robust processes andmechanisms to effectively manage cyber risks. It said that althoughCognizant considered there was limited evidence of improvement
initiatives, security risks, action items, issues, and decision points are
discussed regularly during the Security Risk and Compliance
Committee meetings, which is chaired by the Head of Security
Assurance.
c) It supported the principle of independently testing the effectiveness ofprocesses and systems across PHV operators in London as
appropriate. It provided some observations that it said may be helpful
for future assessment which included a longer time-span and a

Page 54 of 62

greater focus on benchmarks relevant to London private hire toensure that the operator being reviewed is able to provide assessors
with the information they require to fully and reasonably assess theeffectiveness of its processes and systems against clearly definedand relevant benchmarks.
195.
On 21 November 2019, ULL also sent to TfL a set of slides which
provided additional information in areas where Cognizant suggested
weaknesses.
196.
TfL provided Cognizant with the submissions and material
provided by ULL and asked Cognizant to consider these submissions
and give its views on them. TfL asked Cognizant whether any of thepoints raised by ULL led it to alter its conclusions. Cognizant provided its
comments on 21 November 2019 and said that it had carried out athorough review of the points raised by ULL along with the new evidence
shared, and this new information has no material impact on theassessment observations or ratings in the Report. Cognizant does notconsider that there should be any change to the Report. Cognizant also
said that the evidence shared by ULL is largely the same as that it had
reviewed during the workshops except for two new items which it
concludes have no significant bearing on the assessment ratings. It also
said that the observations in its report are a commentary based purely on
the evidence shared and scenarios considered during the assessment
workshops.
197.
Cognizant provided its observations on the specific points madeby ULL which have not been repeated.
198.
Cognizant also referred to the two new items of evidence that ULL
has referred to: the “Cascade screenshot to track configuration changes”
and “Security Risk and Compliance Committee meeting notes”. Whilethese substantiate the assertions ULL has made, Cognizant concludes
that it is difficult to conclude that “these are practised as a process
without due investigation”. However, even on the assumption that theseare practised rigorously, Cognizant does not consider that it affects theoverall ratings described in the Report.
199.
Cognizant commented on the statements within the original reportthat ULL has described as speculative. It agrees that the risks orconsequences outlined in the report are speculative. However, this isdeliberate (and unsurprising). Cognizant explained that, whereas theprocess weaknesses in the report are soley based on evidence, thepossible risks and consequences arising from these weaknesses arenecessarily speculative in nature. Consequently, Cognizant said that itPage 55 of 62

has supplemented this information with the risk severity and probability of
the risk occurring, so as to provide a robust picture.
200.
Cognizant also considered that there are a few specificobservations made by ULL, which it believes are a result of
misinterpretation on ULL’s part, and hence required further clarification
which it provided in its response.
201.
In relation to the overall approach to the assessment adopted by
Cognizant, Cognizant agreed that there is merit in the risk-based
approach suggested by ULL, but said that it in its experience, it suggeststhat the hybrid approach that it adopted for this assessment is better
suited because a stand-alone risk based assessment would be bothincomplete and also ineffective in ironing out the process gaps that cantranslate into major risks in due time.
202.
Cognizant said that it compared ULL’s processes by reference toindustry standards and identified the strengths and weaknesses in ULL’s
processes. In addition, it aligned these weaknesses with potential risks,from TfL’s perspective, thus making it more outcome focussed. It offereda suggestion as to the way in which maturity assessments could be
carried out.
203.
Cognizant acknowleged that the provision of more time for a morethorough assessment would allow the organisation being assessed moretime to provide requested information and for Cognizant to perform
discovery and analysis of shared information.
204.
It is noted that ULL strongly disagrees with the conclusions in
Cognizant’s reports and has highlighted areas that it considers to beeither inaccurate or incomplete. A meeting took place between TfL,
Cognizant and ULL on 22 November 2019 to discuss the report.
Following that meeting, Cognizant wrote to TfL to confirm that the
information provided by ULL does not lead it to make any materialchanges to the IT Service Management Report. It said none of the ULL’s
submission or evidence caused it to change its view and, on the contrary,
the evidence provided by ULL at the meeting served to support
Cognizant’s understanding and assessment.
205.
Cognizant acknowledged that the new evidence on security shows
there are mechanisms to monitor security processes and controls, but
said that it was difficult to trust the authenticity of evidence unlessCognizant does a thorough investigation. However, it confirmed thateven if this new evidence were accepted at face value, it would notchange the overall ratings in other areas such as the Risk Register and
GRC tool which Cognizant has highlighted are still weak areas.

Page 56 of 62

Cognizant said that it would explain certain issues in more detail on 25
November, although this was not received prior to making the decision
concerning ULL’s fitness and propriety . However, the bottom line is that
Cognizant has confirmed that its assessment as to ULL’s IT Service
Management maturity remains the same.
206.
Following the meeting with Cognizant, ULL’s General Manager for
Northern and Eastern Europe sent an email attaching the notes of themeeting. The email notes that all have been working to unusually tighttimeframes on this matter. It said that it is ULL’s strong view that a morethorough review - with due consideration given to all evidence available would have resulted in a ‘meets expectations’ for ULL outcome across allareas.
207.
The email said that ULL is committed to the principle ofindependent testing and to using this feedback to continuously improve
its systems and processes. It reiterated the submissions it made on 19
November 2019 that it has already committed to deploying a number offeatures to further strengthen its processes, including implementing the“Servicenow” GRC solution and to extending its ISO certification to morepassenger and driver systems, as well as the regression testing.
208.
Shortly after the meeting with Cognizant on 22 October 2019, TfL
had a meeting with ULL during which ULL reiterated its concerns about
the conclusions of the Cognizant assessment and the time that wasavailable for a thorough review. On 23 November 2019, the Chair of the
ULL Board wrote to TfL and confirmed that the Board had discussed the
Cognizant report in detail and said that whilst it does highlight someareas where ULL must and will improve, the Report gave the Board noreason to question the underlying safety and security of Uber's systems
and processes, which ULL has and continues to scrutinise intensely
through the bi-annual Assurance Reports and monthly review of safety
and compliance. Ms Power-Freeling said that she and the Board are
personally committed to ensuring ULL continues to improve and lives up
to the high standards TfL rightly expects.
209.
However, as explained in the sections above, TfL considers that,on the basis of the Cognizant Reports, there are a number of
weaknesses in ULL’s systems. These weaknesses described in thereports do not provide TfL with confidence that serious breaches andissues of the kinds described above will not occur again in the future.
TFL’S CONCLUSION IN RESPECT OF ULL’S FITNESS AND PROPRIETYPage 57 of 62

210.
Taking into account the totality of the evidence above, TfL
concluded that ULL is not fit and proper to hold a PHV operator’s licenceat the current time, and its licence should not be renewed.
211.
ULL’s recent track record in relation to breaches of the licensing
framework raises serious concerns in relation to public safety. It is
recognised that ULL has taken steps to address the historic causes of
those breaches. However, the number, pattern, seriousness and causesof the breaches raised serious concerns for TfL as to ULL’s ability toprevent such breaches recurring in the future.
212.
This was why TfL commissioned the Cognizant reports. TfL
hoped that the Cognizant reports would provide it with confidence that
ULL is now in a position to prevent similar breaches and issues arisingagain. The Cognizant reports have indeed provided confidence as to
ULL’s Cyber Security Systems. However, the IT Service Management
Report has led TfL to conclude that it does not have sufficient confidence
in ULL’s ability to prevent future breaches. As set out above, a significant
number of the historic breaches have derived from the introduction of
new or amended versions of the Uber app. The Cognizant ITSM
Assessment has identified this as an area of weakness, in which Uber’ssystems do not meet the standard that it would expect. It is not possible
to be confident that further, serious breaches of the licensing framework
will not occur, or have not already occurred but have not yet been
identified or reported to TfL, placing passengers in London at an
unacceptable level of risk.
213.
TfL therefore concludes that ULL is not a fit and proper person to
hold a PHV operator’s licence.

Page 58 of 62

Right of Appeal
ULL may appeal our decision, information on how to do this is enclosed withthis letter, please read the notice entitled ‘Right of Appeal’.
Section 26(1) of the Act states:“If any decision of the [licensing authority] 1 against which a rightof appeal is conferred by this Act—(a) involves the execution of any work or the taking of any action;(b) makes it unlawful for any person to carry on a business which
he was lawfully carrying on at the time of the decision,
the decision shall not take effect until the time for appealing has
expired or (where an appeal is brought) until the appeal isdisposed of or withdrawn.”
We consider that the purpose of section 26(1), read in context, is to allow an
existing licensee such as ULL, whose application for renewal of its licence isrefused, to continue to carry on business until such time as its appeal isdisposed of or withdrawn. It follows that, where (as here) the decision inquestion is a decision not to renew a licence, the effect of s. 26 is to treat thatdecision – for the period until the appeal is disposed of or withdrawn – as if it
had been a decision to renew.
As such, ULL will be able to continue to operate pending any appeal process.
In the interests of protecting public safety during this period, ULL is expected tocomply the 20 conditions imposed on the two-month licence granted on 25
September 2019. Given the concerns we have raised in this letter, undercondition 4, we require ULL to provide an independent assurance report to TfL
every 3 months from the date of expiry of the current licence (25 November2019). The next assurance report would therefore be due on 25 January 2020
covering the licensing period of 1 October to 30 December 2019. The
conditions are attached. Please confirm by return that ULL will comply with theconditions attached.
TfL has considered whether to exercise its power, set out in s. 26(2) of the 1998
Act, to direct that ULL’s licence should be suspended or revoked withimmediate effect. Taking all the relevant materials into account, it has decided
not to do so because it is not considered necessary or proportionate, in thiscase. We note that ULL has put system fixes in place to prevent any further
driver photo fraud issues arising, and that through Programme ZERO, it isworking hard to reduce and eliminate regulatory breaches.

Page 59 of 62

Additional Information
If you have any further queries regarding this decision, please contact us via thedetails contained at the top of this letter. It is important you quote your reference
number in all communication with us.

Yours sincerely,

Graham Robinson
Interim General Manager
London Taxi and Private Hire | Transport for London

ENC: Application Refusal Additional Information SheetPage 60 of 62

Private Hire Vehicles (London) Act 1998 (as amended)
Section 25 - Appeals(1)This section applies to any appeal which lies under this Act to amagistrates’ court against a decision of the licensing authority, aconstable or an authorised officer in relation to, or to an application for, alicence under this Act.

(2)

If the licensing authority has exercised the power to delegate functions
under section 24, such an appeal shall be heard by the magistrates'
court for the petty sessions area in which the person to whom thefunctions have been delegated has his office or principal office.

(3)

Any such appeal shall be by way of complaint for an order and theMagistrates' Courts Act 1980 shall apply to the proceedings.

(4)

The time within which a person may bring such an appeal is 21 days
from the date on which notice of the decision appealed against is servedon him.

(5)

In the case of a decision where an appeal lies, the notice of the decision
shall state the right of appeal to a magistrates' court and the time within
which an appeal may be brought.

(6)

An appeal against any decision of a magistrates' court in pursuance ofan appeal to which this section applies shall lie to the Crown Court at the
instance of any party to the proceedings in the magistrates' court.

(7)

Where on appeal a court varies or reverses any decision of the licensing
authority, a constable or an authorised officer, the order of the court shallbe given effect to by the licensing authority or, as the case may be, aconstable or authorised officer.

Page 61 of 62

If you intend to appeal against the decision of Transport for London (TfL) to
revoke, vary, suspend, or refuse to grant you a private hire licence you mustcarry out the following procedure.
You must apply to Westminster Magistrates’ Court for a summons
against TfL within 21 days of receiving the written notice of the decision.
• You should write to Westminster Magistrates’ Court, applying for a summons
against TfL. (Please note: there are no official forms for this procedure, youwill have to write a letter stating that you wish to appeal against the decision).
The address of the court is 181 Marylebone Road, London NW1 5BR,
telephone contact 0300 303 0645.
Email address southlondonmc@justice.gov.uk• You should enclose the notice of:-refusal/revocation/suspension/variation from TfL, and any other relevantcorrespondence with the envelope showing the postal date.
• The cost of the application is £60.00. This can be paid via the LMAC team at
Westminster Magistrates Court . (The fee may be waived if you produce
documentary evidence of receiving Income Support/ Jobseekers Allowance)
LMAC contact number 0203 126 3040 email address, lmac1@justice.gov.uk
IF THE APPLICATION IS GRANTED: a summons will be issued against TfL
for hearing at a later date. This date will be an effective date and you will be
required to attend on this and any further dates. You must inform the court inadvance of any dates that are not suitable for you to attend for the hearing.
You MUST attend on the hearing date. The District Judge or Justices
sitting will hear evidence from both parties and then decide whether or
not to uphold the original decision. If the original decision is upheld,
costs may be awarded against you (approx. £600.00). Likewise, if you do
not attend the appeal, it may be dismissed and costs awarded againstyou.
If you wish to withdraw your appeal you must inform the court and TfL in writing
before the hearing date. If you do not give prior notice of your withdrawal you
may incur costs. The fee of £60.00 payable to the court via LMAC may not be
refunded.

Page 62 of 62

Please note that, as this is a civil matter, the court will not provide interpretersin these cases, although a list of qualified interpreters can be obtained fromthe court if you wish to book and pay for one yourself. The services of aninterpreter must be arranged by you before the date of your appeal.
If you wish to know if you can carry on driving/operating once the appeal islodged, please contact TfL.