Download Original Attachment
Chief Constable Data Control Unit Michelle Skeer QPM BA (Hons) Professional Standards Police Headquarters Email freedomofinformation@cumbria.police.uk Carleton Hall T 101 option 2 ext: 60025 Penrith, Cumbria My Reference FOI/69/20/IR CA10 2AU Your Reference cumbriapolice
www.cumbria.police.uk
Alex Haydock [email protected]
25 September 2020
Dear Alex Haydock
FREEDOM OF INFORMATION REQUEST – INTERNAL REVIEW
I refer to your email dated 8 February 2020 in which you requested that an internal review is undertaken in relation to the response provided to your freedom of information request which was received on 14 January 2020 and I apologise for the delay in providing a response to you this has unfortunately been due to current staffing levels and high volumes of work within the Department.
I have now had an opportunity to consider the issues raised in your email and also to review the response provided to you 5 February 2020. I can advise you as follows.
For the avoidance of doubt, I note that your request for information, as set out in your email dated 14 January, sought the disclosure of the following information:-
1. Do you use mobile phone extraction technology that includes cloud analytics / cloud extraction capabilities e.g. Cellebrite UFED Cloud Analyser, Magnet Axiom Cloud or Oxygen Forensics Cloud Extractor 2. Do you have other technologies that allow you to access cloud-based accounts and extract this data. 3. Please provide a copy of the relevant Data Protection Impact Assessment. 4. Please provide a copy of the relevant local and/or national guidance/standard operating procedure/policy. 5. Please confirm the legal basis you rely on to conduct cloud analytics/extraction
The response provided to you on the 5 February was as follows: -
Section 17 of the Freedom of Information Act 2000 requires Cumbria Constabulary, when refusing to provide such information (because the information is exempt) to provide you the applicant with a notice which: (a) states that fact, (b) specifies the exemption in question and (c) states (if that would not otherwise be apparent) why the exemption applies.
The qualified exemption applicable to the information is engaging s31(1)(a)(b) Law Enforcement.
Evidence of Harm
Modern day policing is intelligence led and law enforcement depends upon the development of intelligence and the gathering and security of evidence in order to disrupt criminal behaviour and bring offenders to justice. As criminals adapt and exploit new technology, the police need to respond by overcoming hi-tech barriers in order to meet their responsibilities. In this case the information relates to the extraction of data from individuals’ mobile devices, albeit victim or offender. By revealing specific tactical information such as requested within
this request, would undermine the process of preventing or detecting crime and the apprehension of prosecution of offenders.
Public Interest Considerations for S31(1)(a)(b) Law Enforcement
Factors favouring Disclosure
Disclosure of the information would raise the general public’s awareness that the police are effectively and appropriately extracting information from mobile phones as part of Cumbria Constabulary’s responsibility to delivery effective operational law enforcement.
Factors favouring Non-Disclosure
When the current or future law enforcement role of the force may be compromised by the release of information, the effectiveness of the force will be reduced. In this case, for the reasons outlined in the evidenced harm, the effectiveness of current and future strategies when carrying out investigations and gathering evidence may be compromised.
The personal safety of individuals is of paramount importance to the Police Service and must be considered in response of every release. A disclosure under Freedom of Information is a release to the world and, in this case, disclosing tactical information relating to the extraction of data from individuals’ mobile phones, would undermine the evidence gathering process of any investigative inquiry relating to offences, some of which may be serious cases such as murder or rape.
Balancing Test
As always the Freedom of Information Act has a presumption of disclosure, unless when balancing the competing public interest factors the prejudice to the community outweighs the benefits. In this case, there is an argument for disclosure, inasmuch as the public have a right to know that every effort is made to gather all relevant evidence, including extracting data from mobile phones, but this must be balanced against the negative impact these disclosures can make.
Law Enforcement is reliant on community engagement, intelligence and evidence gathering and when it is appropriate, information is given to the public. What has been established in this case is the fact that disclosure of information relating to technologies used when extracting data would have an adverse effect on the investigative process and on the public prevention or detection of crime and the apprehension or prosecution of offenders. This places the victims of such offending at a greater risk towards their health and wellbeing and is not an action the Police Service would be willing to take. These negatives outweigh any tangible community benefit and therefore the balance does not favour disclosure at this time.
In accordance with the Act, this letter represents a Refusal Notice for this particular request of your request (delete as applicable). This action cannot be taken as confirmation or denial that Cumbria Constabulary holds the information you have asked for.
In respect of question 3. Data protection is an aspect taken into consideration whenever we record, retain or share, any information. As such, all staff in all departments are trained on data protection.
You have within your email dated the 8 February stated the following:-
I am aware that for a refusal under S31, a balancing test must be performed which weighs the factors favouring disclosure against those favouring non-disclosure. I note that you have conducted such a test and that you have detailed the reasons for your decision in your response.
The factors favouring non-disclosure which you make reference to are primarily concerned with the potential for disclosure to compromise the effectiveness of law enforcement. As you
note: “revealing specific tactical information such as requested within this request, would undermine the process of preventing or detecting crime and the apprehension of prosecution of offenders.”
I acknowledge your viewpoint, however I believe it is undermined by the fact that other UK police forces have responded to similar requests more openly.
As you are no doubt aware, my FOI request originated from a campaign by Privacy International to gather information about the use of cloud extraction technology. A number of other police forces have provided clear information about whether this technology is, or is not, being used.
On 12 December 2018 a member of Lancashire Police Department UK told viewers of a Cellebrite webinar that they were using Cellebrite's Cloud Analyser to obtain cloud based 'evidence'. In response to a Freedom of Information request Hampshire Constabulary told Privacy International they were using Cellebrite Cloud Analyser. Similar requests have been answered openly by Kent Police and Wiltshire Police.
In the Cellebrite webinar referenced above, Lancashire noted that their use of cloud analytics predated the existence of national standards or clarity on legal safeguards. They indicated to viewers of the webinar that they took the initiative to create a draft policy and share it with the National Crime Agency and other forces. This leads us to a reasonable belief that the use of this technology is more widespread than just the police forces who have openly responded to requests thus far.
The UK public are largely in the dark about when, how often and why cloud extraction is being used and transparency with regard to these requests would be greatly beneficial so that the public can understand when their cloud-based applications may be accessed. It would also greatly improve transparency around the legal basis used for access, and the frameworks that have been put in place to ensure that individual rights are protected. The public has a right to knowledge about the existence of such practices and the frameworks involved so that such frameworks can be subject to public scrutiny and improved if they are found to be inadequate.
It is my believe that the public interest in the response to this request outweighs any factors favouring non-disclosure under S31, and I request a review of your decision not to disclose.
I have now considered your request and also the original response provided.
I note that you argue that two forces have previously released information into the public domain but historical disclosures are not reflective of the current position and that to confirm or deny the use of such technology would reveal operational capability and tactical options to the significant detriment of UK law enforcement and I am therefore satisfied that the response provided to your request was correct and I do not uphold your appeal.
Complaint Rights Your attention is drawn to the attached sheet, which details your further right of complaint to the Information Commissioner.
Yours sincerely,
E Glendinning Disclosure and Compliance Officer People Department, Corporate Support
Enc