OFFICIAL - SENSITIVE ANNEX OSC INSPECTION POLICE SCOTLAND SECTION 49 NOTICES aw) Part RIPA . Part RIPA provides the legal framework for the recovery of keys and codes used by criminals to prevent access to data contained within, inter alia, telephones and computers (described as ?protected information? in Part 111). A failure to comply with a notice served under Section 49 of the Act to produce such a key/code gives rise to penal consequences. A ?permission? to serve such a notice has to be granted by one of the persons identi?ed within Schedule 2 of the Act as having the authority to grant such ?permissions?. These provisions have not been extensively used by police forces but Police Scotland has determined to utilise them. In the last year the Force has applied for, and been granted, ten permissions to serve such ?Section 49? Notices. (Under the previous structure only- the Force had made applications and then on only three occasions) . The responsibility for the procedure and for the maintenance of Section 49 records rests within the CAB and in particular on the capable shoulders of DC She falls to be commended for the production of a guide ?Investigation of Protected Electronic Information? which is a concise and clearly understandable of some of the relevant parts of Part RIPA. Incorporated within the guide is a procedure which she has developed for the Obtaining of the notices and the recording of steps taken thereafter. . This procedure commences with a request by the investigating Of?cer of the suspect or individual considered to have the code/key to produce the key for any seized equipment. If that is declined the of?cer will request the local forensic laboratory to break the code. Ifthat cannot be achieved the of?cer will refer to the CAB when a direction will be made for the equipment to be delivered to NTAC to break the code. If NTAC fails then it will refer the case back to the Force CAB and reporting of?cer by delivering a Section 49 notice application form with a URN. The individual must again be required to produce the key/code. If that is refused DC - will make enquiries of the reporting of?cer to con?rm that the enquiry has a ?rm foundation in intelligence and not merely a ?shing exercise. Only if she is satis?ed as to the former will the application proceed. . Discussion ensues with the CAB to determine that both necessity and proportionality are satis?ed and correctly recorded on the form after which the form is completed by the reporting Of?cer. Necessity is usually satis?ed by the fact that an ?le exists within equipment seized from an individual in relation to whom there are good grounds to suspect involvement in serious criminality coupled with a re?isal to supply the key. Proportionality is satis?ed by the seriousness of the offence(s), the likelihood of evidence/intelligence within the ?le and the failure to acquire the key by other means (request and failed attempts to break the code). The FAQ is informed of the pending application and the form is again referred to NTAC for its approval. In effect NTAC acts as a gatekeeper OFFICIAL - SENSITIVE 53 OFFICIAL - SENSITIVE and makes comments on the form as it considers appropriate before returning it to the CAB and a copy to the reporting of?cer. . The form is then submitted to the FAO who gives written approval (or not) for the application for ?permission to proceed. The advised course then is to make application for ?permission to a Sheriff who, under Schedule 2 paragraph 1 of RIPA, has power to grant ?permission?. The Sheriff is attended upon in Chambers by an of?cer from the Procurator Fiscal?s Department and the reporting of?cer. The Sherri??, if satis?ed of the statutory requirements, signs the form granting ?permission? to serve a notice and a ?nal date is set within the form for the delivery of the key. The notice is served on the person considered to be able to deliver the key. Failure to comply by the set date with the notice places that person in breach of the notice, unless s/he is able to rely on certain available defences, and an offence under Section 55 of the Act is committed for which s/he may be prosecuted. . These procedures are all recorded on a running log. DC - keeps in contact with the reporting of?cer throughout the procedures. However responsibility for the prosecution of a breach offence rests with the Procurator Fiscal?s Of?ce and it is at this stage that the process has some defect since there is presently no procedure by which the CAB is either informed that a prosecution has or has not been undertaken or the outcome of that prosecution. Such information that is available comes to DC ?as a result of her chasing up the reporting of?cer who in turn may not have been informed of any prosecution or its outcome. . It is of importance to the police that the outcome of the proceedings following a refusal to comply with the notice are known and recorded. It can only be by such that the police can be made aware of the effect of the failure to comply with notices and the value of launching such procedures in the ?rst place. It is therefore of importance that a procedure is introduced whereby the Prosecutor Fiscal informs the CAB of the outcome. Such information should then be attached to the ?le record. See recommendation 1 . However the Force should give consideration to the alternative means by which such ?permission? may be obtained. The structure of Schedule 2 to the Act outlines such procedures which apply in different circumstance but are mainly dependent on the provisions relied upon to make the original seizure and the identity of the Agency making the seizure. A brief, and not comprehensive, outline of the alternative procedures is set out below. Paragraph 1, ?Requirement that appropriate permission is granted by a judge is a ?catch all? provision which may be used irrespective of the powers used to e??ect a seizure. This is the preferred course by Police Scotland at the present time. Paragraph 2 ?Data obtained under warrant etc applies to rotected information? seized etc. by exercise of a statutory power as a result of a warrant granted by the Secretary of State or a person holding judicial of?ce (as de?ned by sub paragraph 8) and to authorisations granted under Part 111 of the Police Act OFFICIAL - SENSITIVE 54 OFFICIAL - SENSITIVE 1997 by an Authorising Officer under Section 93 of that Act. Providing the warrant or authorisation contains the necessary ?permission or the ?permission is subsequently given in writing the Section 49 notice may be served. Paragaph 3 relates to data obtained by the intelligence services. Paragr_aph 4 ?data obtained under statute by other persons but without a warrant? applies to ?protected information? not falling within Paragraph 2, obtained by reason of the exercise of a statutory power exercised by (inter alia) the police and being ?protected information provided or disclosed to (inter alia) the police or is likely to be so provided or disclosed or is in the possession, or likely to come into the possession, of the police. An officer, to have such ?permission must be the of?cer exercising the statutory power (of seizure or otherwise) and must either hold the rank of Superintendent or above or the permission to give a Section 49 Notice has been granted by an of?cer of that rank (Paragraph 6). Paragraph 5 applies principally to the intelligence services although relates to circumstances where ?protected information? comes into the possession of both the intelligence services and the police. - See recommendation 2 A note, seen during the inspection, from the Of?ce (Deputy Principal Crown Counsel) concerned a case arising from a Section 49 notice which had been obtained and served but had resulted in the subject applying for a Bill of Suspension from the Appeal Court Whilst the note indicated that the PF considered that the Bill was withoutlegal foundation because it was an incompetent procedure not available in relation to this legislation it continued to consider the contingency that the Court found against the Crown?s submission. It questions the procedure of applying to a Sheriff for the permission when permission may have been granted by a Superintendent (see Paragraphs 2 and 4 above). Whilst this may have been true in the case in question nevertheless the of?cers followed a proper legal procedure found within the Statute. The only disadvantage of such a course was the possibility that the decision of a Sheriff may be challenged by a Bill of Suspension which would not be available in relation to a Superintendent?s ?permission?. However it was the view of the of?ce that such would be an incompetent procedure. 10. Criticism also appeared regarding the suggested paucity of detail placed within the 11. application for ?permission In fact the application appears to contain that which is required by the Act (see Section It should be appreciated that of?cers, in the absence of information as to content which is cannot be expected to do more than outline the basis for their belief that the information is of consequence to their enquiries. That may be based on little more than an arrest effected in circumstances giving rise to a reasonable belief that the arrestee has committed a serious offence and his seized telephone/computer holds ?les which are protected by a key/code which the arrestee refuses to disclose. It is of importance that a belief by the police that an individual, properly served with a .notice, will never supply the key should not found a basis for not proceeding with a prosecution. It formed part of the consideration in this case. OFFICIAL - SENSITIVE 55 OFFICIAL - SENSITIVE Ultimately this procedure is the only means by which such a key may be recovered and the severe penal consequences of a refusal should be made known to the criminal fratemity. This is of special importance since it affects codes within all iphones and ipads which are common equipment used by criminals and formed the basis of all of the applications viewed during the inspection. 12. The case appears to have been abandoned by the Crown for tactical reasons concerned with the possible risk of a requirement to disclose operational information during the court process. 13. Eight of the ten applications were examined. Two ?les were incomplete and -. They arose from a period when the CAB was adopting its centralised role in relation to Section 49 notices and the state of the ?les was said to arise from the transitional situation. 14. The documentation was generally satisfactory and the records well maintained. Caseswere based on a good intelligence background which was appropriately documented; necessity and proportionality were well considered within the parameters outlined above; in each case a FAQ had given approval for the application to proceed; involvement was appropriately recorded and appropriate dates were set for service giving the recipient time to obtain legal advice. There is a facility for a secrecy requirement to be made within the notice requiring the recipient not to inform others of the notice. In one case there was a note that such would not be included the notice though fact it was The notice normally, as it should, excluded legal advisers ?'om its secrecy provisions. Conclusions 15. This is a new area for Police Scotland, but is likely to be expanded upon since the use of iphones and ipads is common criminal activity. DC - has undertaken her role within the CAB in this regard with zest and enthusiasm. A further expansion of her brie?ng note would help to outline the alternative procedures available which would not require application to a Sheriff. A procedure and recording system has been established which is ef?cient save that it does not record prosecution outcomes. Where the procedure is being used it is done so effectively. Recommendations i. Establish a procedure whereby the CAB is informed of all Section 53(1) prosecutions and their results. ii. Give consideration to the alternative procedures available within Schedule 2 of RIPA. HH Norman Jones QC Assistant Surveillance Commissioner OFFICIAL - SENSITIVE OFFICIAL - SENSITIVE ANNEX POLICE SCOTLAND KEY STAFF MET DURING THE WEEK West Command (including SCD/headquarters of?cers) DCC Iain Livingstone DCC Neil Richardson ACC Ruaraidh Nicolson Detective Superintendent Detective Superintendent Detective Superintendent Detective Sergeant Detective Ser eant Detective Inspector Detective Inspector Detective Inspecto Detective Inspecto Detective Sergeant - Police Sergeant Detective Inspector Detective Inspector North Command Detective Superintendent Command Detective Sergeant Detective Superinten ent Detective InSpector Detective Superintendent Detective Inspector Detective Inspector Detective Superintendent Detective Chief Inspector Detective Superintendent SRO Senior Authorising Of?cer Crime, CT Force Authorising Of?cer cadre Force Authorising Of?cer cadre Force Authorising Of?cer cadre Human Collections (CHIS) - based CAB CAB CAB CAB Specialist Technical Support Counter Corruption Unit Special Operations Unit CII Unit Authorising Of?cer CHIS Controller Divisional Proactive Team- Divisional Intelligence Manager ANPR Co-ordinator CHIS Controller Surveillance Team A0 Cadre Principal AO Northern Northern Area CAB Mana er Northern Area A0 - OCCTU Northern Area AO Reactive CID Organised Crime OCCTU OCCTU PPU OFFICIAL - SENSITIVE 57 OFFICIAL - SENSITIVE Detective Chief Inspector Detective Sergean Of?ce PPU - Proactive Team Detective Inspector -DSU Controller Detective Constables Handlers- DSU Detective Inspectors Controllers Detective Constables -DSU Handlers Detective Inspector East Command Detective Superintendent Detective Superintendent Detective Chief Inspector Detective Chief Inspector Detective Inspector Division Detective Sergeant Division Detective Sergeant Detective Constabl Detective Constabl Detective Inspector Detective Sergeant Detective Inspector AfDetective Inspecto Detective Chief Inspecto Detective Inspector Detective Inspector Detective Sergeant Detective Constable Detective Inspector Detective Inspector Division Detective Constable Division -DSU Controller Force Authorising Of?cer cadre Authorising Of?cer Division East Command Source Units Crime and Operations .Division Offender Management Unit Offender Management Unit Central Authorities Bureau East Central Authorities Bureau East Central Authorities Bureau East Controller -Dedicated Source Unit Controller --DSU Controller - CT DSU OCCTU - Surveillance OCCTU - Surveillance Proactive Unit - Proactive Unit Intelligence Unit q} Cyber Crime Unit OCC Intelligence Manager Intelligence Unit Gatekeeper. OFFICIAL SENSITIVE