Security News > 2021 > May > We'd love to report on the outcome of the CREST exam cheatsheet probe, but UK infosec body won't publish it
British infosec accreditation body CREST has declared that it will not be publishing its full report into last year's exam-cheating scandal after all, triggering anger from the cybersecurity community.
"The Report of the Independent Investigator contains information that was obtained in confidence and in line with both the terms of the Process and CREST's Complaints and Resolution Measures, the Report is confidential and cannot be made public," said CREST in an update published on its website late on 10 May, right before the CyberUK conference began.
Multiple infosec people forwarded this statement to The Register and expressed concern that the scandal was being quietly buried by CREST. One told us he was a strong believer in "What CREST qualifications should mean so I'm hoping that they don't brush it away as I don't honestly believe NCC are quite in the clear here!".
Addressing these concerns, CREST said: "Commitments were made to maintain the confidentiality of all those who contributed to the investigation. This is to protect individuals, members and other relevant parties who have provided information to the independent investigator. Confidentiality provides the protection for contributors and ensures a fair investigation can be conducted. The publication of the full Independent Investigator Report would remove these protections."
CREST is the gatekeeper for security-critical infosec work on UK government and critical national infrastructure.
We understand the company maintains this position while the investigation is ongoing - though doubtless it will be breathing a sigh of relief now CREST has decided not to publish a report into the scandal after all.