Cyber Kiosks – Correspondence to Justice Sub-Committee on Policing
Correspondence from Open Rights Group on the legal basis for the use of forensic kiosks and the scope of the work the Justice Sub-Committee are undertaking.
To Members of the Sub-Committee on Justice and Policing,
Open Rights Group request that members of the Committee seek solutions to the concerns raised in a recent report in the Times (Call for safeguards on police phone hacks, February 15 2019) and the matters arising from recently released correspondence between Crown Office Procurator Fiscal Service (COPFS) and Police Scotland.
In previous correspondence and evidence sessions guidance from the COPFS has been presented by Police as setting out, confirming and providing clarity to the position regarding the legal bases for seizing and searching digital devices, including of the use of forensic kiosks. The released correspondence of 30 January 2019 fails to provide any clarity. Further, COPFS seek in that letter to place the entire burden of determining and providing legal guidance as on seizure on Police Scotland. This apparent divergence of view as to responsibility for understanding and explaining the law raises fundamental questions about law the whole process of seizure and search of digital devices in Scotland.
Additionally, it appears that advice from the Legal Services team in Police Scotland contains relevant material on the legal basis of the proposed forensic kiosks and the powers available affecting terms lawful search and seizure.
That advice should be made available fully to the Justice Sub-Committee on Policing members, to the External Reference Group created by Police Scotland (of which ORG is a member), and the general public to allow for proper assessment of the proposed legal basis.
The lack of clarity and comprehensibility about the group of legal powers Police Scotland seek to rely on affects current and past practice affecting the existing “Cyber Hub” examination centres. It appears that the proper solution to this discussion is to understand that rolling out forensic kiosks requires describing the whole process of policing powers for the seizure and search of electronic devices in Scotland.
Open Rights Group encourages the Sub-Committee to:
– Request release of the Legal Services memo to Police Scotland in full.
– Expand the Committee’s consideration of Police Scotland to include the full seizure and search of digital devices in Scotland,. i.e. the existing Cyber Hubs.
Open Rights Group have been an open and willing participant in the Cyber Reference Group convened by Police Scotland to discuss the proposed use of forensic kiosks in police stations across Scotland. We have attended 4 meetings since July 2018, contributing time, expertise and guidance to crafting a modern policing framework. Police Scotland has expressed thanks for this effort and assistance in enabling them to thoroughly ground their practices and procedures.
Throughout this engagement Open Rights Group, as well as other organisations including Privacy International, the Information Commissioner’s Office and the Scottish Human Rights Commission, have repeatedly requested further clarification regarding the legal basis for the roll-out of these kiosks. These participants in the Reference Group have also asked a number of times to have the regional Cyber Hubs (where seized devices are currently being sent to be fully searched and assessed for admissible electronic evidence) included in the Cyber Reference Group discussions.
On 4 January, ORG’s representative Dr Duncan Campbell wrote to DCS McLean, DS McCourt and member of the group to raise these two core issues:
“It seems clear from the November Justice Committee hearing and the Convener’s letter, and from comments made by colleague organisations, notably the Faculty of Advocates, that the precise asserted bases in law for different situations of seizure or acquisition has not been addressed with enough rigor by COPFS, whose failure to provide a written paper is increasingly an impediment to your intentions and Group members’ ability to assist.
Secondly, our Group’s reference terms and name now clearly seem a misnomer in that the kiosks are an enhancement to pre-existing wider forensic processes including the forensic “Cyber Hubs”. The sense from recent events is that it is not appropriate or sensible to review legalities solely in relation to the Kiosks, as opposed to the overall process.”
Dr Campbell has not to date had a response to this letter. At the External Reference Group meeting of 10 January 2019, a PowerPoint display on legalities was presented. Although requested, this presentation has not been circulated to group members for review.
Previous submissions to the Sub-Committee by Open Rights Group have raised questions regarding the clarity of the current legal framework and to consider this issue in a holistic manner. Submissions from 13 November 2018 to this Committee raise both of these points explicitly.
The response to these requests has been that Police Scotland are satisfied with the current legal framework provides sufficient clarity to offer a clear legal basis for the use of forensic kiosks and by extension that the pre-existing Hub operations. Detective Chief Superintended McLean when questioned by Liam McArthur on November 18 2018 confirmed:
“The intention with the introduction of cyberkiosks is to introduce a triage process to stop so many devices going to the cyberhubs. The legal basis for both [emphasis added] those systems is the laws that I previously described.”
That same evidence session, DCS Mclean makes reference to the legal advice received from Police Scotland that was taken internally that satisfies Police Scotland that the powers that are described provide a legal basis to search and seizure those items.
The existence of a legal basis is premised on the requirement that it is accessible and it is foreseeable. These are well-established principles in human rights law dating back to the 1980s (Silver and Others v. the United Kingdom). This includes sufficient foreseeability that individuals are able to act in accordance with the law, as well as a clear demarcation of the scope of discretion for public authorities.
The correspondence from COPFS of 30 January 2019 declines to provide confirmation of the Data Protection and Human Rights implications of processing information whilst seizing and investigating digital devices, explaining that it is for Police Scotland as a public authority to satisfy themselves of this. The correspondence cites the advice from Police Scotland’s own Legal Services, this advice should now be released to the public as it seems to be the only document that may provide a clear statement of available legal basis for the operation of seizure and search of digital devices.
Finally, it is only through looking at the entire process of seizure and search of digital devices, from the proposed forensic kiosks as triage to the existing practice of the cyberhubs analysing seized devices, that we can create a modern, accessible framework for the Scottish public to better understand their rights, and the limits of Police Scotland’s powers.
As DCC Ian Livingstone acknowledged in his evidence session from 13 January 2019 where it was confirmed that the rollout of cyber kiosks had been paused “we did not reach out as broadly as we could have done and did not absolutely establish and articulate the clear legal and rights-based authority for the use of the equipment.” This acknowledgement rings true for the entire search and seizure process.
Open Rights Group hopes to contribute to a wider discussion on this issue in the future and welcomes the opportunity to engage the Sub-Committee members.