Equipment Interference Code of Practice for Police Scotland – Consultation Response

Open Rights Group Scotland’s response to the Regulation of Investigatory Powers (Scotland) Act Equipment Interference DRAFT Code of Practice.

Recommendations

General:

• Scotland’s code should wait for Home Office sign-off on own code to make sure procedures are harmonized.
• ‘least intrusive’ means guidance need to be improved.
• Reasons for approving should be retained as written and records keeping should apply to thematic warrants.
• Incidental conduct should be reported to authorizing body.

Thematic warrant recommendations:

• Thematic warrants should be clearly articulated as a last resort, if used at all.
• All changes to thematic warrant should be treated as a modification and reported to issuing body.

Oversight

• Improved role for Scottish oversight institutions.

General 

Await Home Office sign-off on own code for harmonisation.

Open Rights Group and others have made significant submissions to the Home Office’s Code of Practice for Equipment Interference. The Equipment Interference Code of Practice remains in draft form even now.[2] Harmonisation of powers is important to maintain consistency across law enforcement in the UK and Open Rights Group does not consider it advisable that a code of practice is passed in Scotland before the Home Office confirms its own Code of Practice.

Changes called for could include information relating to “least intrusive means”, a greater emphasis on freedom of expression and opinion, clarifying comments for the powers of the judicial commissioner, to name just a few areas raised in responses to the Home Office consultation. It would be foolish for the Scotland to take a path and set of rules before knowing the state of play in England and Wales and assessing the suitability of those rules for Scotland’s Code of Practice for Equipment Interference.

Open Rights Group encourages the Government to hold back on confirming this Code of Practice for Equipment Interference in the Regulation of Investigatory Powers (Scotland) Act 2000 until it has had a chance to review the confirmed code of practice from the Home Office.

“Least intrusive means” requires guidance

Reference to the Investigatory Powers Act requirement at (s.2(2)a) that public authorities must have regard to whether any ‘warrant, authorisation or notice could reasonably be achieved by other less intrusive means’ is reflected throughout the Code of Practice. This is a crucially important test, but one that lacks any comprehensive guidance in the codes.

At points, the Code makes reference to an applicant considering the “least intrusive means” available before applying for a particular authorization for equipment interference. However, there is nothing in the Codes that attempts to set out a scale of intrusion leaving it unclear as to how intrusive various powers might be considered by the government. For example, is the use of a Communications Service Provider to look up the location of a mobile phone any less intrusive than deployment of an Equipment Interference implant providing just GPS to the requesting agency? If so, why?

The Intelligence and Security Committee in its report (page 19) on the murder of Fusilier Lee Rigby that they hold a view on a rough order of intrusion of capabilities suggesting that intercept is more intrusive than directed surveillance techniques.

Given the important role of the test in ensuring the technique being deployed is both necessary and proportionate, Open Rights Group recommends that the Code of Practice is redrafted to include a comprehensive exemplar scale of the types of intrusion that can be permitted by the Investigatory Powers Act, and how they compare in the Government’s view as to their intrusiveness.

Reasons for approving should be retained as written and record keeping should be applied to thematic warrants.

Open Rights Group are confused by the record keeping provisions the Code of Practice sets out. When it comes to retaining written reasons, there appears to be a discrepancy between targeted and thematic warrants and also on approval or rejection of warrants.

At 3.33 the Code of Practice notes the Investigatory Powers Act does not mandate how Judicial Commissioners must show or record their decision for targeted equipment interference. It states that a Judicial Commissioner can provide oral approval to issue a warrant but for refusal of a warrant, they must give the person written reasons. This two tier system creates a disincentive for refusal, creating a more permissive environment for approval of a warrant. Reasons for approval should also be written down and retained to maintain equality between approval and rejection.

At 6.5 record keeping for assistance of Investigatory Powers Commissioner, the information to be recorded only mentions targeted equipment interference applications. The same level of information to be retained should be applied to thematic warrants.

Unforeseen Incidental conduct should be reported to authorizing body.

There is a need for close supervision of the effects and permissiveness of equipment interference, any incidental conduct should be reported to the issuing authority and oversight bodies.

Incidental conduct is any conduct necessary to undertake what is expressly authorized. At 3.100 the Code of Practice requires the applicant to expressly set out any foreseeable incidental conduct to the issuing authority to consider. In the event of unforeseen incidental conduct, the code of practice states it as permissible and lawful for all purposes. There is no requirement to report the unforeseen incidental conduct to the issuing authority or oversight bodies. 

Equipment Interference powers are new to crime fighting Scotland, having never before been a power for agencies like the Police Service of Scotland to exercise. Because of this, these powers need to be kept under close scrutiny to assess their effect. Giving a pass to things like unforeseen incidental conduct provides a far too permissive environment for such novel and intrusive powers at this early stage. The Code of Practice should be reworded to require incidental conduct reporting to be made, whether foreseen or unforeseen, to give a clearer picture of how the Police are interpreting the activity required under these warrants to achieve their purpose.

Thematic warrants

Thematic warrants should be clearly articulated as a last resort, if used at all.

The Code of Practice at 3.62 sets out the premise and coverage of targeted thematic warrants available to the Police Service of Scotland. These warrants “can cover a wide range of activity; it is entirely possible for a thematic warrant to cover a wide geographical area or involve the acquisition of a significant volume of data.” While the code goes into some detail around 3.64 and 3.65 for specificity of the target or targets of warrant the Code of Practice sets out another option where a thematic warrant is not reasonably practicable to include additional subject-matter details, the example at 3.65 being given the issuance of a warrant for anyone using a particular website.

This level of generality allowed in a warrant risks creating a general warrant, something which there has been a common law rejection of in Scotland since 1857 in the case of Webster v. Bethune, and even earlier in the commentaries of such institutional writers for Scotland’s law such as Hume.

Open Rights Group and others are concerned that thematic warrants are not lawful under UK law or the European Convention on Human Rights. This includes the Joint Committee on the Draft Investigatory Powers Bill (“Joint Committee”) which expressed deep concerns regarding thematic warrants concluding that “the current wording…is too broad”. It recommended, at para 468 “the language of the Bill be amended so that targeted interception and targeted equipment interference warrants cannot be used in a way to issue thematic warrants concerning a very large number of people.”

All changes to thematic warrants should be considered modifications and reported to the issuing authority.

At 3.74 the Code of Practice states that non-thematic warrants cannot be modified in any way that would alter the conduct authorized, this is an encouraging sign but the permissiveness of thematic warrants is concerning. At 3.76 where a thematic warrant that does not specifically name or describe every subject of the interference, modifications are not required if the equipment falls within the description in the warrant.

Any changes to a thematic warrant, whether that be persons or equipment, including warrants that describe persons or premises generally, should be considered a modification and reported to the issuing authority immediately.  Thematic warrants need to be limited in their ability to allow general acts of interception and kept under close supervision and requiring any changes in target to be reported to the issuing authority is the best way to begin achieving that end.

Oversight

Improved role for Scottish oversight institutions.

The Code of Practice places oversight roles at The Investigatory Powers Tribunal and the Investigatory Powers Commissioner. While these institutions are necessary to be included for the scope of the Investigatory Powers Act it is concerning to see the Code of Practice considers any role to play for Scottish institutions, whether they be political or independent.

The powers this Code of Practice is providing for requires oversight from an independent body such as the Investigatory Powers Commissioner. However, the bodies this applies to are the Police Service of Scotland and the Police Investigations and Review Commissioner. These are Scottish bodies that have oversight currently provided by bodies such as the Scottish Policing Authority and Holyrood’s Justice Sub-Committee on Policing. 

These oversight bodies have a more functional relationship in overseeing Scottish agencies than the UK bodies and for them to be left out of an oversight structure for these powers is a misstep. If the Scottish Minister is required to pass this Code of Practice to provide these powers there should be some level of political oversight from Scotland to make sure this Code of Practice is being applied appropriately and restricting the agencies where it should.

Open Rights Group advises that the Justice Sub-Committee on Policing, which has as its remit the operation of the Police Investigations and Review Commissioner, should be included in the oversight of these powers and the Code of Practice, capable of holding hearings with the Investigatory Powers Commissioner, the Police Service of Scotland, and the Police Investigations and Review Commissioner. 

The Scottish Policing Authority has oversight of the role of Chief Constables in the Police Service Scotland, in particular to keep under review the policing of Scotland as the Police and Fire Reform (Scotland) Act 2012 lays out. This code discusses creating significant new powers which will have an effect on the policing of Scotland. The Scottish Policing Authority should be included to provide assistance to the Investigatory Powers Commissioner in their review of Equipment Interference powers in Scotland as it relates to their remit. The Scottish Policing Authority’s role should also include their ability to ask questions and review Chief Constables’ role in this Code of Practice.