The Guessing Game: Next steps from Scottish Government on Cyber Kiosks

On Thursday 13 June 2019 the Cabinet Secretary for Justice Humza Yousaf will take a seat in Committee Room 6 in the Scottish Parliament in front of the Justice Sub-Committee on Policing. He will then reveal what the Scottish Government intends to do to modernise the legal framework for seizing and searching electronic devices by Police Scotland. Anything short of announcing legislative reform would be a disappointment, and a failure of the Government to live up to the standards they have set themselves.

Open Rights Group have been following the cyber kiosk roll-out in Scotland since last year. In May 2018 it was revealed that Police Scotland had trialled the use of kiosks, and purchased 41 kiosks without sufficiently establishing human rights and data protection impacts of seizing an electronic device and using advanced surveillance technology to search through the device to reveal its contents.

While the Scottish Government are yet to reveal their approach to this issue, Open Rights Group’s position is clear, from a recent report released in May: reform the law, bring it up to modern standards, apply it to the whole process of seizing, searching and forensically examining electronic devices, and respect the human rights of everyone in Scotland.

The cyber kiosks, provided by Israeli company Cellebrite, have the ability to access “contacts, chats (Facebook, Signal, Twitter, WhatsApp) instant message, MMS, SMS, call logs, unlock patterns, device location, and thousands of deleted items including browsing history, photos”, which are all stored on the phone’s memory.

The Justice Sub-Committee on Policing released a report in April summarising their investigation into the issue of the cyber kiosk roll-out. The had many of the same concerns, as ORG: there was not enough clarity in the law for seizing these devices; not enough thought demonstrated from the Police in terms of the human rights impacts; and worryingly not enough done to inform the public in Scotland that this roll-out was taking place.

Police Scotland have maintained that the legal basis for seizing and searching electronic devices is clear, that they believe there is no need to update the legal framework prior to rolling out the cyber kiosks. They intend to roll out the kiosks late this Summer. Ultimately, they argue that electronic devices can be covered in the legal framework that has been established, there is no need for a modernisation exercise.

ORG disagreess. These devices are not like other pieces of property that have come before it: they provide more insight than our calendars, carry more intimate details of our lives than our personal diaries, reveal more about our relationships than letters or notes. For that reason ORG and others have been calling for an update to the legal framework to reflect the fundamental difference in electronic devices compared to any other piece of property, increasing safeguards and removing the power of Police to seize devices without a judicial warrant.

The Sub-Committee’s report was responded to by Cabinet Secretary for Justice Humza Yousaf on 3 June 2019. The response suggested the Scottish Government shared those same concerns about the revealing nature of the technologies involved:

I would…acknowledge the points made around the ability of the future legal framework to keep pace with the rapidly evolving world of communications technology; and of giving confidence that, as the technology changes, our law enforcement agencies can continue to fulfil their essential functions, whilst respecting the rights of those involved

I can therefore confirm to the Sub-Committee that the Scottish Government is currently considering how it can assist on this important point ahead of giving evidence on 13 June. I would hope to say more to the Sub-Committee at that point.

It is not yet known what the Scottish Government is intending to do to help modernise the legal framework to sufficiently balance the essential functions of law enforcement whilst respecting the fundamental rights of others. That makes this committee hearing incredibly important.

Open Rights Group have submitted their report “Seizing the Future” as formal evidence to the Sub-Committee.

We are not intending to stand in the way of Police Scotland doing their vital and important job, but we do intend to stand up for human rights which require the law to be clear and sufficiently protect individual’s privacy against arbitrary interference.

We expect the Scottish Government make that same stand.

The hearing will take place at 1pm in Committee Room 6. It can be streamed on Scottish Parliament TV.