OFFICIAL Our Ref: Date: IM-FOI-2019-0324 2 May 2019 FREEDOM OF INFORMATION (SCOTLAND) ACT 2002 - INTERNAL REVIEW In accordance with section 20(1) of the Freedom of Information (Scotland) Act 2002, I understand that you have requested a review of the decision communicated to you on 7 March 2019 in respect of your original request for information, received 6 February 2019. Please accept my apologies for the delay in providing a response. Original Request 1. I would like to know how many of the following types of devices have been subject to data extraction or some other kind of digital forensic investigation in the 2017 and 2018 calendar years: * Mobile phones * Desktop computers * Laptop computers * Tablets * External hard drives or storage devices * Other digital devices 3. Please confirm how much has been spent on specialist hardware and software to facilitate digital forensic investigation activities in each calendar year. Please break this expenditure down by supplier / product. Request for Review I am writing to request an internal review of Police Scotland's handling of my FOI request 'Digital device analysis'. I am disappointed that Police Scotland provided so little information with regards to this request. In particular, I would be keen to receive some information on the numbers of devices analysed. I note that Police Scotland were previously able to provide this information. A previously submitted FOI request, using similar wording to this one, did result in the release of information. If it is possible to release updated figures that are comparable with the data released in previous years, I would be grateful if you could consider doing so link provided With regards to Q3 of my FOI, I note for example, that you have previously released some details pertaining to Police Scotland use of Cellebrite tools link provided In light of these precedents, please review the entire initial response to my FOI request and consider whether it is possible to release more information. OFFICIAL scotland.police.uk @PoliceScotland PoliceScotland OFFICIAL My role is to consider the response issued and determine whether or not your request was handled in accordance with the provisions of the Freedom of Information (Scotland) Act 2002. As part of the review, I am also required to consider the quality of the administrative process applied to your request and I note that your request was not responded to by the 20 working day legislative deadline. The Force has therefore clearly failed on this occasion with regard to this legislative obligation and for that I apologise. In reviewing the response I have studied all documentation relevant to the request, including that which documents both the research carried out and the decision making process. The decision I have to make is whether or not section 12 of the Act was correctly applied to question one of your request and whether or not section 17 of the Act was correctly applied to question three of your request. Consideration of Police Scotland Response to Question One: Having consulted with colleagues in our Cybercrime Policy and Coordination Unit I can confirm that the case management system introduced in 2016 categorises all forms logged as either ‘phone’ or ‘computer’ and they are not thereafter subcategorised in terms of any search capability. I am advised that it’s wholly possible that the form will be marked as a ‘phone’ case but also contain computer related devices and vice versa. To be of assistance however, I can advise that for 2017, there were 5,270 forms categorised in the system as ‘phone’ and 1,660 categorised as ‘computer’. For 2018 there were 5,520 forms categorised in the system as ‘phone’ and 1,240 categorised as ‘computer’. At a conservative estimate of three minutes per form to review the content in terms of devices submitted and note the detail, conducting this exercise is estimated to involve 685 hours of work - equating to a cost (at £15 per hour) of £10,275. Taking all of the above into account, I am satisfied that your request has been handled in accordance with the Freedom of Information (Scotland) Act 2002 and in terms of section 21(4)(a) of the Act, I uphold the original response and agree that section 12 of the Act was correctly applied. OFFICIAL scotland.police.uk @PoliceScotland PoliceScotland OFFICIAL Consideration of Police Scotland Response to Question Three: Having consulted with colleagues in our Cybercrime Policy and Coordination and Finance Units, I must conclude that there is information of relevance held in relation to your request. I have consulted the finance records in relation to the Cybercrime Policy and Coordination Unit and, in particular, the spend logged under the category of ‘IT purchase’. It is not impossible that other costs will have been incurred that may be of relevance to your request but without going through the ‘IT purchase’ records of every department of Police Scotland it is impossible to say. Taking all of the above into account, I am not satisfied that your request has been handled in accordance with the Freedom of Information (Scotland) Act 2002 and in terms of section 21(4)(b) of the Act, I overturn the original response as I do not agree that section 17 of the Act was correctly applied. Whether these items could be classed as ‘specialist’ however, as per the terminology used in your request, or whether the purpose is to ‘facilitate digital forensic investigation activities’ is a matter of subjective assessment. Notwithstanding, I can provide you with the following information: 2016/17 ‘IT Purchase’ spend: £24,499.12 (This figure takes account of a credit of £870.36 which relates to an adjustment for costs incurred in the 2015/16 financial year) Recorded suppliers: AVATU ltd Cellebrite Computacenter United Kingdom ltd. DELL Computer Corporation ltd Digital Detective Group HP Inc. UK ltd INSIGHT Direct UK ltd MISCO UK ltd Vector & Scalar Products ltd Recorded product descriptions: Tableau Supertkit Tableau - T35u Dell Precision Tower 7910 Xcto Option 1 Intel X520 Dp 10gb Da/Sfp+ Server Adapter,Ful Sfp+, 10gbe Sr/Sx, Optical Transceiver, Lc Co Seagate Constellation Es.3 St1000nm0033 Hard Alienware 17 R4 Laptop Netanalysis V2x - Forensic Recovery Suite (Us OFFICIAL scotland.police.uk @PoliceScotland PoliceScotland OFFICIAL Hardware purchase Trade In From Ufed Touch 1 Toufed4pc With Kit Hgst Ultrastar 7k4000 Hus724030ale640 Hard Dr 242 Hp Elite Display E242 Hight Adjstable Ips 24" Hp Elite Display E242 Hight Adjstable Ips 23" Lcd Monitor (2553211) - Input Requirement Seagate Barracuda 3tb 3.5 Sataiii Internal Ha Seagate Constellation Es 4tb 3.5 Sata Int - S Seagate Barracuda 3tb 3.5 Sataiii Internal Ha Seagate Barracuda 3tb 3.5 Sataiii Internal Ha Seagate Expansion 1tb Portable - 2492818 Wd Av Green 1tb 3.5 Sata Int Hd - 193912 Wd Av Green 1tb 3.5 Sata Int Hd - 193912 Encase Forensic 8 & Encase Portable v4 Payment of invoice 2 x Hard Drives 2017/18 ‘IT Purchase’ spend £334.80 (This figure takes account of a credit of £885.91 which relates to an adjustment to centralise all ICT related costs) Recorded suppliers: MISCO UK ltd WEX Photographic IANSYST ltd Recorded product descriptions: 128gb Microsdxc Read Card Service-Prospec Usb 3.0 Multi-Card Reader Service-Prospec Usb 3.0 Multi-Card Reader Read And Write Gold Atw V11.5 Mobile (Rwg-11Read And Write Gold Atw V11.5 Single (Rwg-11. Mindgenius Business V6 Single (Mbu-V6-01) - A In terms of Section 16 of the Freedom of Information (Scotland) Act 2002 I am refusing to provide you with an itemised list per product/ supplier. Section 16 requires Police Scotland when refusing to provide such information because it is exempt, to provide you with a notice which: (a) states that it holds the information, (b) states that it is claiming an exemption, (c) specifies the exemption in question and (d) states, if that would not be otherwise apparent, why the exemption applies. I can confirm that Police Scotland holds the information that you have requested. OFFICIAL scotland.police.uk @PoliceScotland PoliceScotland OFFICIAL The exemption that I consider to be applicable to the information requested by you is set out at section 33(1)(b) - commercial interests: Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person. The information held relates to the provision of goods and services to Police Scotland from third party suppliers, the disclosure of which would, in my view, lead to a commercial detriment to both parties. Whilst there is a public interest in better informing the public as to the financial activities of Police Scotland and the companies involved, there can be no parallel interest in the disclosure of information which would lead to the commercial interests of Police Scotland or any third party being jeopardised. On balance, the public interest must lie in ensuring that companies can trust in Police Scotland not to disclose information which would render them less able to compete in the open market. Should you require any further assistance concerning this matter please contact Information Management - Dundee quoting the reference number given. If you remain dissatisfied following the outcome of this review, you are thereafter entitled to apply to the Office of the Scottish Information Commissioner within six months for a decision. You can apply online, by email to enquiries@itspublicknowledge.info or by post to Office of the Scottish Information Commissioner, Kinburn Castle, Doubledykes Road, St Andrews, Fife, KY16 9DS. Should you wish to appeal against the Office of the Scottish Information Commissioner's decision, there is an appeal to the Court of Session on a point of law only. OFFICIAL scotland.police.uk @PoliceScotland PoliceScotland