NAP remains unimplemented three years after APS attack