NOT PROTECTIVELY MARKED





3





POLICE

SCOTLAND

Keeping people safe

 

 

COMMUNICATIONS DATA

Standard Operatinq Procedure

 

Version 1.00

 

Owning Department:

Specialist Crime Division

 

Author Reviewer:

 

 

 

 

 

 

 

 

 

 

 

 

Version number: 1.00
Date Published: 06/08/13
Due for review on: 21/07/14
EIA Completed: Yes
ECHR compliant: Yes
Data Protection compliant: Yes

FOI compliant: No
Health Safety compliant: Yes
GPMS compliant: Yes
Records Management compliant: Yes

 

NOT PROTECTIVELY MARKED

 

 



w>m_m




0.999me

wOrmm 



NM UmmeZ

Nw m_ZQ_ _m 

NA mmZ_Ow O_n_n_O_mE

Nm 



m; 

mm 

ma 

mt. 

mm _Z._.wcm_OZ

m6 

mN UwOOmUCwmm
Wm 

35X 

03 :m 

UwO<_Umwm I EmOO<mw<


m<=umZOm





O_u_u_O_m

S290: 600 1504m04_<mr< 

APPENDICES

Appendix 
Appendix 
Appendix 
Appendix 
Appendix 
Appendix 
Appendix 
Appendix 
Appendix 

Appendix 
Appendix 
Appendix 

Version 1.00

NOT PROTECTIVELY MARKED

Division

Division

Division

and Divisions

and Divisions

Division

Divisions
Division

List of Associated Legislation
List of Associated Reference Documents
List of Associated Forms
Glossary of Terms

NOT PROTECTIVELY MARKED

In Use





1.1

1.2

1.3

1.4

2.1

2.2

2.3

2.4

NOT PROTECTIVELY MARKED

PURPOSE

This Standard Operating Procedure (SOP) establishes procedures that
ensures that the Police Service of Scotland manages its acquisition
and use of communications data in accordance with legislation, and the
Home Office ?Acquisition and Disclosure of Communications Data? Codes of
Practice.

This document also aims to give police officers and police staff guidance on
how to apply for and/or use communication data as part of their operational
duties whilst also providing direction to senior officers (Designated Person)
who may be required to authorise such obtaining and/or use of
communications data.

The role of the Communications Data Single Point of Contact (SPOC) is a
challenging role balancing the needs of investigators, safety of the public etc
with the responsibility of adhering to the Regulation of Investigatory Powers
Act 2000 and European Convention on Human Rights (ECHR) that
falls upon them and P808.

Most applications are straightfonNard but the local SPOC officer is there to
help applicants, to advise on best way to proceed, and provide guidance on
how data applied for should be used. When you are faced with something out
of the ordinary they should be able to offer advice and assistance.

LEGAL BASIS

The procedures described in this document are founded on the provisions of
the following Act which provides a legal basis for the lawful access to
communications data by public authorities including police forces; Part 1 of
Chapter 2 of the Regulation of Investigatory Powers Act 2000 (RIPA).

The main purpose of the Act is to ensure that the relevant investigatory
powers are used in accordance with the European Convention of Human
Rights.

Part 1 of Chapter 2 of the Regulation of Investigatory Powers Act 2000,
requires that human rights principles are followed. Officers must ask
themselves the following questions:

. Is the proposed action lawful?
. Is the proposed action necessary (for a legitimate aim)?

. Is the proposed action proportionate to the crime or incident being
investigated (not a sledgehammer to crack a nut 

. Is the action non-discriminatory?

Before utilising any of the powers under this act.

Version 1.00 NOT PROTECTIVELY MARKED 4

2.5

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.6

2.6.1

3.1

NOT PROTECTIVELY MARKED

HUMAN RIGHTS

The access to communications data in accordance with the relevant
legislation ensures compliance with the Human Rights Act 1998 and the
principles of the ECHR. The legislation provides a basis for accessing
communications data in relation to a wide variety of crimes and offences
within the general confines of proportionality and necessity.

It is vital that the management of all access and subsequent use of
communications data is subject to the highest possible standards of
professional integrity so that due cognisance is taken of, and protection
afforded to, individual human rights.

Moreover, in so doing the entire process is safeguarded and can withstand
independent scrutiny and examination carried out regularly by the
Interception of Communications Commissioners Office (IOCCO) who submits
the report on any errors to the UK Home Office and Senior Police Officers.

P808 is a designated public authority and as such is required to act in a way
and apply legislation so that it is consistent with the Convention of Human
Rights. One of the underlying principles of the Convention is that a public
authority can only infringe certain rights, such as the right to privacy (Article
8), if there is a legal framework that allows it to do so.

Article 8 - Right to Respect for Private Family Life, states the following:
?Everyone has the right to respect for his private and family life, his
home and his correspondence?.

There shall be no interference by a public authority except as in accordance
with the law and is necessary in a democratic society in the interests of
national security, public safety or the economic well-being of the country for
the prevention of disorder or crime, for the protection of health or morals, or
for the protection of the rights and freedoms of others.

CODE OF PRACTICE

An Acquisition and Disclosure of Communications Data Code of Practice has
been issued by the Home Office and approved by parliament on 1 October
2007. The code of practice provides guidance to public authorities on the
correct procedures for accessing communications data under the provision of
Part 1 of Chapter 2 of the Regulation of lnvestigatory Powers Act 2000. The
code of practice is deemed admissible in evidence in both criminal and civil
proceedings.

DEFINITION OF COMMUNICATIONS DATA

Part 1, Chapter 2 Regulation of lnvestigatory Powers Act 2000 (RIPA) defines
communication data into three separate types. These being:

Version 1.00 NOT PROTECTIVELY MARKED 5

3.2

4.1

4.1.1

4.2

4.2.1

4.2.2

4.2.3

NOT PROTECTIVELY MARKED

1. Information Held by the Service Provider on a Person (section 21 (4) 
this includes subscriber details, method of payment details, billing
address, other records.

Authorisation rank for Data Inspector or above

2. Use Made of a Communication Service (section 21(4) - itemised
billing of calls, web sites visited and other similar records.

Authorisation rank for data Superintendent or above

3. Traffic Data (section 21 data comprised in or attached to a
communication for the purpose of the postal or communication service 
incoming call data, cell site location information, call line identity, and
other records.

Authorisation rank for A data Superintendent or above

The Act provides two different ways of authorising access to communications
data, referred to as ?Authorisation? and ?Notice?.

AUTHORISATIONS AND NOTICES
AUTHORISATION

This provides for persons within a public authority (SPOC) to engage in
specific conduct relating to a postal service or telecommunications
Communications Service Provider (CSP) system, to obtain communications
data. An authorisation may be appropriate where:

. there is an agreement in place between a public authority and a CSP
relating to appropriate mechanisms for disclosure of communications data,
or

. a designated person considers there is a requirement to identify a person
to whom a service is provided but a CSP has yet to be conclusively
determined as the holder of the communications data, or

. a CSP is not capable of obtaining or disclosing the communications data.
NOTICE

This is given to a postal or telecommunications service CSP provider and
requires that service provider to collect or retrieve the data and provide it to
the public authority which served the notice.

Authorisations and Notices will only be valid for one month and can be
renewed for a further period if required.

The authorisation or notice should be cancelled as soon as it is no longer
necessary or the conduct is no longer proportionate to what is sought to be
achieved.

Version 1.00 NOT PROTECTIVELY MARKED 6

4.2.4

4.2.5

5.1

5.2

5.3

5.4

5.5

5.6

5.7

NOT PROTECTIVELY MARKED

The application authorisation process is subject to inspection by the IOCCO
and the applicant, the SPOC (accredited officer) and the designated person
(authorising officer)(DP) may be required to justify their decisions and actions.

The Communications Investigation Unit (CIU) will manage the authorisation
process on behalf of P808 and provide the necessary guidance to the
designated person in this regard.

ACQUIRING COMMUNICATIONS DATA

The obtaining and use of communications data is now an essential
investigative tool which can be utilised, in accordance with certain conditions,
for the investigation of all levels of crime, disorder and public safety.

Communications data can take many forms from basic subscriber information
required to confirm the owner of a telephone, telephone billing data, postal
information, through to complex internet enquiries where Internet Protocol
addresses are required along with log in history and other technical
data.

Communications Data includes:

. Information relating to the use of a postal service or a telecommunication
Communications system but does not include the contents of the
communication itself, contents of e-mails or interactions with websites.

. Data in relation to a postal item means anything written on the outside of
the item.

In other words the term ?communications data? embraces the ?who?, ?when?
and ?where? of a communication but not what was said or written.

It includes the manner in which, and by what method, a person or machine
communicates with another person or machine. It excludes what they say or
what data they pass on within a communication (with the exception of traffic
data to establish another communication such as that created from the use of
calling cards, redirection services, or in the commission of ?dial through? fraud
and other crimes where data is passed on to activate communications
equipment in order to fraudulently obtain communications services).

Postal services are described as any service which consists of the collection,
sorting, conveyance, distribution and delivery of postal items and is offered or
provided as a service the main purpose of which, or one of the main purposes
of which, is to transmit postal items from place to place (See section 2(1) of
the Act.).

Communications services are described as any service which consists of the
provision of access to, and for making use of, any communications system
(whether or not one provided by the person providing the service) the purpose
of which is to transmit communications using electrical or electro-magnetic
energy. (See section 2(1) of the Act)

Version 1.00 NOT PROTECTIVELY MARKED 7

5.8

5.9

5.10

6.1

6.2

NOT PROTECTIVELY MARKED

Communications data may only be sought if a designated person believes it is
necessary for one or more of the following purposes:

. In the interests of national security,

0 For the purpose of preventing or detecting crime or of preventing disorder,
. In the interests of the economic well-being of the United Kingdom,

. In the interests of public safety,

. For the purpose of protecting public health,

. For the purpose of assessing or collecting any tax, duty, levy or other
imposition, contribution or charge payable to a government department,

0 For the purpose, in an emergency, of preventing death or injury or any
damage to a person?s physical or mental health, or of mitigating any injury
or damage to a person?s physical or mental health,

. To assist investigations into alleged miscarriages of justice - Article 

. For the purpose of assisting in identifying any person who has died
otherwise than as a result of crime or who is unable to identify himself
because of a physical or mental condition, other than one resulting from
crime - Article 

. For the purpose of obtaining information about the next of kin or other
connected persons of such a person or about the reason for his death or
condition - Article 

Detecting crime includes establishing by whom, for what purpose, by what
means and generally in what circumstances any crime was committed. For
the gathering of evidence for use in any legal proceedings and the
apprehension of the person (or persons) by whom any crime was committed,
see section 81 (5) of the Act.

Given the ever changing and rapidly developing world of phones and the
internet access capability of many devices the data which can be retrieved by
law enforcement agencies changes almost weekly. In order to achieve the
best outcome for each communications enquiry, advice and guidance should
be sought from the local SPOC for each and every investigation.

NATIONAL PRIORITISATION GRADINGS

Due to the volume of enquiries received by the CSPs a national prioritisation
grading scale has been devised. This is applied by the SPOC to all requests
for communications data. This ensures that the CSPs can prioritise each
enquiry and respond within the appropriate time period.

The grades can be broadly categorised as follows:

. Grade 1 An immediate threat to life

. Grade 2 An exceptionally urgent operational requirement for the
prevention or detection of serious crime or a credible and immediate threat
to national security

Version 1.00 NOT PROTECTIVELY MARKED 8

6.2

7.1

7.1.1

7.1.2

7.2

7.2.1

7.2.2

7.2.3

NOT PROTECTIVELY MARKED

. Grade 3 All other enquiries

NB. Serious Crime where a person over 21 years old would expect 3 years
in prison even if a first offence

The SPOCs responsible for Local Policing Areas will determine the grading to
be applied to each application. An out of hours call out provision exists for
Grade 1 enquiries. Call out for all other enquires will require a prior
arrangement to be in place.

ROLES I RESPONSIBILITIES
APPLICANT

The applicant is a person involved in conducting an investigation or operation
for a relevant public authority who makes an application in writing or
electronically for the acquisition of communications data.

The applicant completes an application form, setting out for consideration by
the designated person, the necessity and proportionality of a specific
requirement for acquiring communications data.

Applications may be made orally in exceptional urgent circumstances but a
record of that application must be made by the SPOC demonstrating the
consideration given to the circumstances and the decisions taken to include
times and DP considerations. Copies of Command and Control incidents and
missing persons reports should be accessible as part of the audit process.

On no account should an applicant make direct contact with the various
Communication Service Providers (CSPs). Contact with CSPs can only be
carried out by accredited SPOC.

Consideration should be given by the applicant to carrying out ?open source?
checks on telephone numbers etc prior to applying for subscriber information
as the data required may already be available to the general public via the
internet, telephone directories, police systems etc.

DESIGNATED PERSON

The Designated Person (DP) is a person holding a prescribed office in a
relevant public authority (lnspector/Superintendent) who is responsible for
considering the application and where they believe it appropriate, necessary
and proportionate in the specific circumstances, can grant an authorisation or
a notice.

The DP must ensure that they grant authorisations or give notices only for
purposes and only in respect of types of communications data that a DP of
their office, rank or position in the relevant public authority may grant or give.

The DP must assess the necessity for any conduct to acquire or obtain
communications data taking into account any advice provided by the SPOC.

Version 1.00 NOT PROTECTIVELY MARKED 9

NOT PROTECTIVELY MARKED

7.2.4 The DP should not, where possible, be responsible for granting authorisations
or giving notices in relation to investigations or operations in which they are
directly involved, although it is recognised that this may sometimes be
unavoidable, especially where it is necessary to act urgently or for security
reasons.

7.3 SINGLE POINT OF CONTACT

7.3.1 The Single Point of Contact (SPOC) is either an accredited individual or a
group of accredited individuals trained to facilitate lawful acquisition of
communications data and effective co-operation between a public authority
and a Communication Service Provider (CSP). To become accredited an
individual must complete a course of training appropriate for the role and
have been issued a SPOC Personal Identification Number (PIN). Details of all
accredited individuals are available to service providers for authentication
purposes.

7.3.2 An accredited SPOC promotes efficiency and good practice in ensuring only
practical and lawful requirements for communications data are undertaken.
The SPOC is responsible for providing objective judgement and advice to
both the applicant and the DP. In this way the SPOC provides a ?guardian
and gatekeeper? function ensuring that public authorities act in an informed
and lawful manner.

7.3.3 The SPOC role will be undertaken by staff of the Communications
Investigation Unit or staff within confidential departments.
7.3.4 The SPOC should be in a position to:

. assess whether the acquisition of specific communications data from a
CSP is reasonably practical or whether the specific data required is
inextricably linked to other data;

. advise applicants on the most appropriate methodology for acquisition of
data where the data sought engages a number of 

. advise applicants and designated persons on the interpretation of the Act,
particularly whether an authorisation or notice is appropriate;

. provide assurance to designated persons that authorisations and notices
are lawful under the Act and free from errors;

. provide assurance to service providers that authorisations and notices are
authentic and lawful;

. assess whether communications data disclosed by a service provider in
response to a notice fulfils the requirement of the notice;

. assess whether communications data obtained by means of an
authorisation fulfils the requirement of the authorisation;

. assess any cost and resource implications to both the public authority and
the CSP of data requirements.

Version 1.00 NOT PROTECTIVELY MARKED 10

7.4

7.4.1

7.5

7.5.1

7.5.2

7.5.3

7.5.4

7.5.5

7.5.6

7.5.7

8.1

8.1.1

NOT PROTECTIVELY MARKED

SENIOR RESPONSIBLE OFFICER

Every relevant public authority must appoint a Senior Responsible Officer
(SRO) who is responsible for:

. the integrity of the process in place within the public authority to acquire
communications data;

. compliance with Part 1 Chapter 2 of the Act and with this code, and

. oversight of the reporting of errors to the Commissioner and the
identification of both the cause(s) of errors and the implementation of
processes to minimise repetition of reported errors.

COMMUNICATIONS INVESTIGATIONS UNIT

The focal point for covert investigation techniques will be the Communications
Investigation Unit (CIU).

The CIU will act as the ?gatekeeper? and will be the central depository for all
authorised forms in relation to accessing communications data.

Therefore all applications for communications data will be directed through
the CIU who will provide any necessary advice on their completion, prepare
the necessary ?authorisation form? or ?notice? and arrange for approval by the
appropriate level of DP.

Accredited staff within the CIU are the nominated SPOCs in relation to
communications data and therefore they are the only persons authorised to
speak with the Service Providers. The CIU will be responsible for the upkeep
of all records in respect of requests for communication data.

Officers must immediately notify the CIU when the requirement for obtaining
communications data is complete or no longer required and the authorisation
notice will be duly cancelled.

Applicants who receive data in response to an application must check its
accuracy numbers, periods and any other information is as authorised.
Report any errors immediately.

The CIU will be responsible for the upkeep of a database of all requests for
communications data carried out by officers of the force. They will ensure that
all forms are completed accurately, timeously and are duly authorised.

APPLICATION AUTHORISATION PROCESS

APPLICATION PROCESS

When an officer considers that obtaining communications data is necessary
and believes the action is justified and proportionate to what it seeks to

achieve, the officer should complete the formal Communications Data
Application Form, as per local processes.

Version 1.00 NOT PROTECTIVELY MARKED 11

NOT PROTECTIVELY MARKED

8.1.2 Contact should be made with the local Communications Investigation Unit to
establish the correct process to follow.

8.2 APPLICATION FORM

8.2.1 An authorising officer cannot approve anything that is not specified in the
application, even if it is implied. It is best practice therefore that the
application form should contain detailed information within the body of text
contained within each section of the form and must include a reference to the
nature of the investigation, any complainer, suspect and what type of data is
being requested from the service provider.

8.2.2 By statutory right the following information must be provided in applications
for communications data:

The grounds on which the authority is sought (statutory purpose);

in the interests of national security;

for the purpose of preventing or detecting crime or of preventing disorder;
in the interests of the economic well-being of the United Kingdom;

in the interests of public safety;

for the purpose of protecting public health;

for the purpose of assessing or collecting any tax, duty, levy or other
imposition, contribution or charge payable to a government department;

for the purpose, in an emergency, of preventing death or injury or any
damage to a person?s physical or mental health, or of mitigating any injury
or damage to a person?s physical or mental health.

To assist investigations into alleged miscarriages of justice Article 2(a)

For the purpose of assisting in identifying any person who has died
otherwise than as a result of crime or who is unable to identify himself
because of a physical or mental condition, other than one resulting from
crime Article 

For the purpose of obtaining information about the next of kin or other
connected persons of such a person or about the reason for his death or
condition Article 2(b)(ii)

Type of communications data requested i.e subscriber details, itemised
billing, traffic data, for example:

The telephone number, IP Address, data is requested on including
name of service provider if known;

Time period involved;

Details of the investigation or operation and the information requested
is deemed necessary;

Why the obtaining of the data requested is proportionate to what you
are seeking to achieve;

Any potential collateral intrusion (the impact on third parties not subject
to the operation);

Version 1.00 NOT PROTECTIVELY MARKED 1-2

8.3

8.3.1

8.3.2

8.3.3

8.3.4

8.3.5

8.4

8.4.1

NOT PROTECTIVELY MARKED

Any timescales for the results i.e. you have a specified court date.
NECESSITY

In order to justify the application it is necessary for the applicant to cover
three main points:

. crime offence circumstances (?the event?) under investigation;

0 suspect(s) offender(s) witness(es) victim(s) (?the person?) and how the
person(s) is/are linked to the event;

. telephone number(s), lP Address(es) etc (?the communication?) and how
this/these relate or link the person and the event.

Sensitive sources of intelligence or covert investigation techniques may be
referred to in the application and the applicant must be mindful of the
appropriate security handling of the application once completed. It may be
sufficient to refer to an intelligence reference number within the body
application dependant on the security issues involved.

NB. The local SPOC may not have access to the SID system.

The information given by the applicant (which includes ?background
information? or the ?intelligence case?) should be set out within an application
under the headings of Necessity and Proportionality (which includes the
consideration of meaningful collateral intrusion). This will minimise the need
to repeat information within an application and enable the process to be
streamlined.

In essence, necessity should be a short explanation of the a) event, b) the
person and c) the communication and how these three link together.

Event



Person Communication

 

The SPOC officer based in the CIU will determine the grading to be applied to
each application.

PROPORTIONALITY
Applicants should outline how obtaining the data will benefit the investigation
or operation. Two basic questions which must be answered are:

0 ?What are you looking for within the data to be acquired??

. ?If the data contains what you are looking for, what will be your next
course of action??

Version 1.00 NOT PROTECTIVELY MARKED 13

8.4.2

8.4.3

8.4.4

8.5

8.5.1

8.5.2

8.5.3

8.5.4

8.5.5

8.6

8.6.1

8.6.2

NOT PROTECTIVELY MARKED

The relevance of any time periods requested must be explained outlining how
these periods are proportionate to the event under investigation. Do not apply
for 2 weeks of data when you are only concerned with a 3 day window.

An explanation as to how communications data will be used, once acquired,
and how it will benefit the investigation or operation will enable the applicant
to set out the basis of proportionality.

An investigation or operation which is seeking to acquire several sets of traffic
data or service use data should engage with the SPOC to develop strategies
(or collection plans) to obtain the communications data and the detail of that
strategy may be included within the application.

COLLATERAL INTRUSION

Collateral Intrusion forms part of the ?Proportionality? considerations and
becomes increasingly relevant when applying for traffic data or service use
data.

Applicants should outline specifically what collateral intrusion may occur; how
the time periods requested impact on the collateral intrusion; whether they are
likely to obtain data which is outside the realm of their investigation and
outline their plans for managing it.

For example: during the course of an investigation and to establish certain
facts it may be necessary and proportionate for an investigator (applicant) to
require access to communications data that relates to witnesses as well as
the associates of a suspect or target.

The question to be asked is, ?Will the data set to be acquired result in
collateral intrusion to persons outside the line of enquiry the data is
being obtained for?? For example, due to the very specific nature of
telephone subscriber check/s, collateral intrusion on a person other than the
subscriber detail/s will be consistently absent whereas itemised billing on the
subject?s family home will be likely to contain calls made by the family
members.

On receipt of the completed application form at the CIU, the application will be
examined to ensure that all issues have been properly addressed by the
applicant and that the application is necessary, justified and proportional and
that collateral intrusion and steps to minimise same have been considered.

APPROVAL PROCESS

On receipt of the completed application form, the CIU will quality assure the
form and thereafter prepare the necessary paperwork for the Designated
Person (DP) (Authorising Officer).

The DP must consider the necessity, proportionality and justification of the
communications data being applied for.

Version 1.00 NOT PROTECTIVELY MARKED 14

8.7

8.7.1

8.8

8.8.1

8.8.2

8.8.3

8.8.4

9.1

9.2

9.3

NOT PROTECTIVELY MARKED

STREAMLINED PROCEDURES

If an application relates to traffic data under 821(4)a or service use data
under 821(4)b and the applicant considers that they will require subscriber/
account information in relation to specific communication numbers identified
within that data, then these subsequent checks can be approved by the DP
when authorising the application for traffic data or service use data.

CANCELLATION

Authorisations or notices served on a SPOC or Service Provider must be
cancelled where the requirement for the Communication Data requested
ceases.

In other words when a service provider is requested to provide data of
whatever description and the grounds for obtaining the data are no longer
justified, for whatever reason, the authorisation must be immediately
canceHed.

The applicant must timeously notify the CIU that the communications data
they have requested is no longer required specifying the reason for the
canceHa?on.

On receipt of the notification that communications data requested is no longer
required the CIU will timeously notify the service provider of the requirement
to cease providing the communications data requested. Dependent on the
circumstances this can be carried out verbally but must always be followed by
a formal written notification of cancellation.

LIFE AT IMMEDIATE RISK SITUATIONS

Arrangements are in place for accredited SPOCs to provide out of office
hours cover in respect of immediate life at risk situations (for the purpose, in
an emergency, of preventing death or injury or any damage to a person?s
physical or mental health, or of mitigating any injury or damage to a person?s
physical or mental health) by way of an on call rota. The on call officer is
available via mobile phone and the conduit for calling an on-call SPOC is via
a senior officer, however the control room should be contacted in the first
instance.

In life at immediate risk situations, (Grade 1), a DP may provide oral authority
to obtain communications data from the relevant service provider. This
authority will only be given to a SPOC.

DPs can only give authority for the level of activity in accordance with the
standard authorising processes. The time the authority is agreed, together
with the details of the activity approved should be recorded in writing by the
SPOC to whom the DP spoke. To justify an oral authority the case must be
one whereby the time taken to apply in writing would, in the judgement of the
person giving the authority, be likely to endanger life or to jeopardise the
operation.

Version 1.00 NOT PROTECTIVELY MARKED 15

9.4

9.5

10.

10.1

10.2

10.3

10.4

11.

NOT PROTECTIVELY MARKED

The same quality of information as required for a written application will be
given verbally to the DP when making oral application. DPs giving oral
authority will make and keep a suitable record of the authority. Retrospective
forms are not required to be completed by the applicant but a full record of
activity should be collected by the SPOC through a SPOC log.

An email will be sent by the SPOC to the DP the next working day outlining
the verbal discussions held, and requesting confirmation by return email of
the services authorised and date and time of authorisation. Both emails will
be saved to the case file created by the SPOC for the enquiry.

DROPPED SILENT I 999 OR 112 CALLS

There exists a ?golden hour? or ?emergency period? which is ?within one hour of
the termination of an emergency call?. Following the initial receipt of a
dropped or silent 999 112 call where concern exists as to the reason for the
999 call the Contact Centre Control Room Inspector can call upon an
Emergency Operator or relevant service provider to disclose data (subscriber
and location information) about the call maker to enable the provision of
emergency assistance.

The Command and Control incident should be tagged marked where
subscriber information is obtained within the ?Golden Hour?. This will allow a
suitable audit to be carried out in relation to data obtained within the 'Golden
Hour.

The CIU Manager should conduct regular spot checks of the Command and
Control system to ensure that the process is being properly adhered to.

The Command and Control incident should also contain the following details
to allow a resume? of the incident to be maintained for audit purposes:

. Command and Control incident number,

. Telephone number subject to subscriber check,

. Communications Service Provider involved,

. Time call received,

. Time CSP contacted, and

. A short explanation re how contact was made with the CSP and who at
the CSP carried out the check.

SERVICE PROVIDERS COST RECOVERY

It is nationally recognised that service providers incur costs in complying with
notices and authorisations to disclose communications data, and RIPA allows
for arrangements for making appropriate payments to them to facilitate the
timely disclosure of communications data.

Version 1.00 NOT PROTECTIVELY MARKED 16

12.

12.1

12.2

12.3

12.4

12.5

NOT PROTECTIVELY MARKED

?Timely disclosure? means that ordinarily a service provider should disclose
data within ten working days of being required to do so.

The major service providers have established Police Liaison Units to
accommodate formal requests for communications data. A number have also
created on-Iine systems which have been made available to accredited
SPOCs via the secure PNN system.

In essence applying for communications data costs money and this
should be borne in mind at all times when applying for data. An approximate
cost will be calculated by the SPOC as part of their assessment section of the
application form and the DP will be informed accordingly to allow them to
consider the costs involved when considering the application.

INFORMATION AVAILABLE FROM MOBILE TELEPHONES

There are two main areas where information can be stored on a mobile
telephone, the actual handset and the Subscriber Identity Module (SIM) card.
Each holds various information; data from both these locations can be
retrieved using specialist software and made available to the Enquiry Officer.
These can include details of:

. Short Message Service (SMS) messages - text messages;
. Address book;

0 Call history;

. Dialled numbers; and

Pictures/images.

Only information held on the mobile telephone or SIM card when it was
seized can be retrieved during the course of an examination.

SMS (text) messages are physically stored on the mobile telephone or SIM
card. Messages that were already on the mobile telephone when it was taken
possession of can, therefore, be retrieved during the forensic examination
process. Similarly, photographs taken using the mobile telephone are
physically stored on the telephone and can, therefore, be retrieved.

Voicemail messages, however, are stored on the remote server of the
relevant Communication Service Provider (CSP) and can only be accessed
by dialling a specific voicemail number. They cannot, therefore, be retrieved
as part of the forensic examination process.

To listen to, download and/or record mobile phone voicemail messages
lawfully the essential point is where the voicemail information is held. In the
case of mobile telephone voicemail, and similarly the British Telecom (BT)
?1571? service, the voicemail is not held on the recipient?s device, but is held
on a platform owned by the service provider.

Version 1.00 NOT PROTECTIVELY MARKED 17

12.6

12.7

12.8

12.9

13.

13.1

13.2

13.3

13.3

13.5

NOT PROTECTIVELY MARKED

There are essentially four ways of obtaining this information lawfully:
1. First Minister?s warrant
2. Sheriff?s warrant

3. Written consent from one party of the communication with a directed
surveillance authority governing the lack of consent from the other party.

4. Written consent from both parties subject of the communication (caller and
recipient).

Option 1 is not generally proportionate and option 4 is unlikely to be
forthcoming if a criminal act has occurred; thus leaving options 2 and 3
available.

Advice on a case by case basis will be provided by the CIU.

Be aware however that the obtaining of Voicemails is generally time critical
with the service providers only holding the voicemail for a very limited time
period once deleted they will not be retrieved.

INTELLIGENCE VERSUS EVIDENCE

Normally communications data obtained as a result of an investigation can be
used in evidence unless the data is marked ?For Intelligence Purposes Only?.
This would normally only occur in relation to some specialist ?Traffic Data?
whereby the type of data or method of retrieval being made available in the
public domain would jeopardise the future use of such ?covert? methods.

There may be occasions where it is deemed necessary to apply for
communications data in respect of building up intelligence on a
particular operation then re-applying for the same information to lead as
evidence. (This varies by region throughout Scotland see Appendix In
such occasions the decision whether the requirement to re-apply for the data
is necessary will be made by the DP who will be made aware of the full
circumstances relating to the previous request and the data already held by
the SPOC.

In general the services which should be protected are the services obtained,
entitled ?Traffic Data? under Section 21 of Part 1, Chapter 2 Regulation
of lnvestigatory Powers Act 2000 (RIPA). This data can also be described as
?Sensitive Data?.

The CIU will be responsible for deciding which material is deemed not
suitable for use in evidence.

Advice on the use of communications data in evidence will be provided by the
CIU - The Director of Intelligence or the Senior Responsible Officer (RSO) will
make any final arbitrary decisions where necessary in relation to the use of
communications data in evidence and where necessary discuss the matter
with the relevant Procurator Fiscal (PF).

Version 1.00 NOT PROTECTIVELY MARKED 18

14.
14.1

14.1.1

14.1.2

14.1.3

14.2

14.2.1

15.

15.1

15.2

15.3

15.4

NOT PROTECTIVELY MARKED

ENGAGEMENT WITH PRIVATE COMPANIES
COMMUNICATIONS DATA

For the purposes of progressing enquiries where the use of communications
data has been obtained and the Senior Investigating officer (SIO) considers it
necessary to utilise the services of a specialist private company (this may
include locus survey), the SIG will first contact the CIU to discuss this and
after establishing what services are required, the CIU will then liaise with the
various companies that are able to provide the service required, obtaining
costing and timescales from them. In accordance with Best Value principles,
a minimum of three options will be obtained where practical. This information
will then be transmitted to the SIG who will consider the costings.

Where a decision is made by the SIG to obtain the services of an external
company the CIU will notify the relevant representative of that company and a
meeting hosted by the SIG will be arranged.

A representative of the CIU will also attend this meeting to give further advice
on what communications data can be utilised by that company. It should be
noted that only communications data which can be evidenced will be
provided for use by such companies.

PAYMENT FOR SERVICES

It is the responsibility of the to seek authorisation from the
appropriate budget holder, not being the CIU budget, prior to obtaining the
services of a private company.

MALICIOUS AND NUISANCE COMMUNICATIONS

Many Communications Service Providers (CSPs) offer services to their
customers to deal with complaints concerning malicious and nuisance
communications. Although these services may vary, all CSPs hold that such
calls can be very distressing for their customers and that every effort should
be made to resolve such situations as efficiently as possible.

The victim of malicious or nuisance communications may, in the first instance,
bring it to the attention of their CSP rather than report it to the police.

Although contacted directly by a customer, the CSP may consider the
circumstances of the complaint to be such that the customer will be advised
to report the matter without delay to the police for investigation.

Additionally, the CSP can offer practical advice and assistance when dealing
with nuisance communications; for example, arrange a change of telephone
number. Indeed many complainers merely wish for the malicious or
nuisance communications to cease and do not wish for a full police
investigation to be undertaken.

Version 1.00 NOT PROTECTIVELY MARKED 19

15.5

15.6

15.7

15.8

15.9

15.10

15.11

15.12

15.13

NOT PROTECTIVELY MARKED

The advice given by the CSP to the complainer may indicate that the
circumstances constitute a criminal offence. The CSP may choose to disclose
data directly to its customer relating to the source of the malicious or nuisance
communications, but must ensure that such disclosure complies with the
provisions of both the Data Protection Act 1998 and an individual?s rights of
pnvacy.

Upon receipt of a complaint, a CSP may retrieve and retain relevant specific
data that, if appropriate, can be disclosed to the police at a later date.

If the complainer wishes the matter to be investigated, it is essential that the
CSP and the police (via the SPOC) liaise with one another to ensure the
lawful disclosure of data for investigative purposes.

Where the complainer subsequently reports the matter to the police, having
previously been in contact with their CSP, any data already collated by the
CSP may be disclosed to the police SPOC under the provisions of the Data
Protection Act. Subsequent police investigation may require the acquisition or
disclosure of additional communications data from the complainer?s CSP (or
another CSP) under the provisions of the Act. In this instance, an application
for communications data should be submitted via the Pegasus database or
equivalent. Where a crime has been identified, it is essential that the police
record it in accordance with the Scottish Crime Recording Standards (SCRS).

Where the initial complaint is either reported to the CSP or directly to the
police, careful consideration should be given to whether the occurrence of
malicious or nuisance communications are, or may be, related to other
incidents or events. For example, this could be where the complainer is a
victim of another crime or is a witness or jury member in either an ongoing or
forthcoming criminal trial.

Where any offence appears to have been committed, but the victim does not
wish the police to investigate, the victim should be referred to their CSP for
advice as to alternative options available to them. The victim must
understand the risk of losing time and evidence if they later change their
mind. If it is a customer service matter, it is important that the police realise
that there are a number of different CSPs, each with differing procedures.
The police should advise the victim to contact the customer service
department of their CSP to identify the options available to them in each case.

Some Internet and e-mail companies have no personal or telephone contact.
Where this is the case, the victim should be advised to contact their CSP
using e-mail or Internet.

Where a crime appears to have been committed but the victim has not made
the decision to pursue a police investigation, the police must still record that
crime in accordance with SCRS.

The significant impact silent calls can have on victims must be recognised,
even where there is no evidence of human malice and no obvious connection
to other incidents involving the victim.

Version 1.00 NOT PROTECTIVELY MARKED 20

15.14

15.15

15.16

16.

16.1

16.2

16.3

16.4

16.5

16.6

16.7

NOT PROTECTIVELY MARKED

In such circumstances, the victim should always be referred to the CSP for
initial investigation. The CSP will, where possible, eliminate the possibility of
a system fault or an erroneously programmed auto-dialler before the matter is
taken further. It is recognised that some CSPs are unable to determine the
use of auto-diallers.

Silent calls of the type described above may now be dealt with by OFCOM as
?Persistent Misuse of an Electronic Communications Network or Electronic
Communications Service? under sections 128-131 of the Communications Act
2003.

The Act allows for fines of up to ?5000, plus compensation, to be imposed by
OFCOM. OFCOM has been advised that persistent misuse does not,
however, constitute an offence and a case is only likely to end up in the
courts where they have to pursue for payment of any fine imposed.

SPAM

Spam can be divided into two categories:

. Unsolicited Commercial E-mail (UCE) Spam (which, despite its name, can
arrive by e-mail, phone, fax or SMS text), and

. Other Spam that forms part of more concerning events where there is
evidence of human malice specifically targeted at the victim such as
stalking intimidation, threats or similar.

UCE spam is akin to ?junk mail? and should not be a police matter. Although
some UCE spam is sent unlawfully, the source of much of it is untraceable.
Additionally, where it is sent from abroad, there can be problems prosecuting
due to the restrictions on the jurisdiction of UK courts.

Where a victim has been the subject of UCE spam, they should be advised to
avoid replying to these communications and consult their service provider for
options open to them to prevent further UCE being received.

However, where the subject of UCE spam appears to have lost money as a
result of it through deception or fraud, the police should investigate the
matter.

The Department for Business Enterprise Regulatory Reform (BERR) have
undertaken a consultation on the implementation of the European Union
directive on privacy and electronic communications.

One of the aims of this directive seeks to regulate the use of communications
networks for unsolicited direct marketing.

Up to date information can be obtained from the BERR website.

Version 1.00 NOT PROTECTIVELY MARKED 21

NOT PROTECTIVELY MARKED

16.8 Where the victim seems to be in receipt of advance fee ?419? fraud Spam1 via
the Internet, they should be asked to hand a copy of the full e-mail, including
the header and complete sender details, to their local police for the attention
of the Fraud Squad. The Fraud Squad will collate the details and pass it to
Operation Dryad at the Serious and Organised Crime Agency (SOCA) for
their information. They should also contact their service provider to establish
options open to them to prevent the receipt of further spam.

16.9 Victims that have lost money due to advance fee ?419? fraud should contact
the West African Organised Crime section of SOCA direct on 020 7238 8012,
in addition to consulting their service provider to establish options available to
them to prevent further spam. SOCA will co-ordinate the investigation which
will be conducted by the victim?s local police force. SOCA will forward the
complaint to the appropriate police force for local investigation. NB - The laws
from Section 419 and laws in place in other jurisdictions criminalising the
offences do not deter criminals who profit from these crimes.

16.10 Where UCE spam received via the Internet contains the following, it should
initially be reported to the Internet Watch Foundation (IWF) rather than to the
police or CSP:

. Images of child abuse anywhere in the world;

. Adult material, received in or sent from the UK, that potentially breaches
the Obscene Publications Acts 1959;

. Criminally racist material sent from or received in the UK.

16.11 In these cases, the IWF conduct the initial investigation into the matter to
establish if and where the crime has been committed and then pass it to the
relevant police authority for full investigation.

17. ROLE OF THE INTERCEPTION OF COMMUNICATIONS
OFFICE (IOCCO)

17.1 Independent oversight of communications data is provided by the Interception
of Communications Commissioner?s Office (IOCCO) under the direction of the
Interception of Communications Commissioner who reports directly to the
Prime Minister.

17.2 An Inspectorate has been formed within IOCCO to assist the commissioner in
the discharge of his review responsibilities under RIPA.

 

1 *Advance fee fraud or ?419? fraud (named after the relevant section of the Nigerian Criminal Code) is
a popular crime with the West African criminal element. There are a myriad of schemes and scams
that amount to promises designed to facilitate victims parting with money. Most involve requests to
help move large sums of money with the promise of a substantial share of the cash in return,
although other scams are employed. Often a person?s identity is obtained in order that the fraudsters
can use this identity to make their approaches to other potential victims more credible. The person
whose identity is ?Stolen? does not necessarily lose money themselves but may become aware that
their identity has been assumed.

Version 1.00 NOT PROTECTIVELY MARKED 2-2

NOT PROTECTIVELY MARKED

17.3 Inspections take the form of comprehensive examination of the processing of
requests for communication data applications and authorisations.

17.4 will provide IOCCO with all assistance required during any inspection,

which will be facilitated by the SRO. The manager of the CIU will be the
conduit for the SRO in any contact with IOCCO.

Version 1.00 NOT PROTECTIVELY MARKED

23

NOT PROTECTIVELY MARKED

APPENDIX 
LIST OF ASSOCIATED LEGISLATION

. Regulation of Investigatory Powers Act 2000,

. The Regulation of Investigatory Powers (Acquisition and Disclosure of
Communications Data: Code of Practice) Order 2007,

0 Human Rights Act 1998,

. Data Protection Act 1998.

Version 1.00 NOT PROTECTIVELY MARKED 24

NOT PROTECTIVELY MARKED

APPENDIX 

LIST OF ASSOCIATED REFERENCE DOCUMENTS
. Home Office ?Acquisition and Disclosure of Communications Data? Codes of
Practice,
. Bomb Threats and Suspicious Packages SOP,
. Directed Surveillance SOP,
. Threats to Life SOP,
. Crime Investigation SOP,
. Digitally Stored Evidence SOP,

. Internet, Research and Investigations SOP.

Version 1.00 NOT PROTECTIVELY MARKED 25

NOT PROTECTIVELY MARKED

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

APPENDIX 
GLOSSARY OF TERMS
CAB Central Authorities Bureau
CSP Communication Service Provider
CTIS Counter Terrorism Intelligence Section
DP Designated Person
ECHR European Convention on Human Rights
IOCCO Interception of Communications Commissioner?s Office
IP Internet Protocol
PIN Personal Identification Number
PSU Professional Standards Unit
RIPA Regulation of Investigatory Powers Act 2000
SB Special Branch
SPOC Single Point of Contact
SRO Senior Responsible Officer
UCE Unsolicited Commercial Email
Version 1.00 NOT PROTECTIVELY MARKED

26