Police Scotland to roll out 'cyber kiosks'
Police Scotland will next week roll out the use of ‘cyber kiosks’, allowing officers to bypass encryption to read personal data from certain digital devices, including some models of mobile phones or laptops, without using a password.
The force bought 41 cyber kiosks, which it had intended to roll out to police stations across Scotland from autumn 2018, before postponing their introduction amid concerns over the legal basis for their use.
The Scottish Police Authority faced criticism from the Scottish Parliament’s Justice Sub-Committee on Policing for a lack of effective scrutiny, while MSPs warned Police Scotland had not followed best practice before trialling the devices.
During the trials, police in Edinburgh and Stirling searched the mobile phones of suspects, witnesses and victims without undertaking the required governance, scrutiny and impact assessments, the committee said.
But Police Scotland said the Crown Office and independent senior counsel had now confirmed the legal basis for use of the technology, which are also known as digital triage devices, with implementation starting in the Forth Valley and Fife Divisions.
Guidance from Police Scotland says: "The ability to bypass security measures such as PIN codes varies depending on the make and model of the device, the version of the operating system being used, and any security measures enforced by the manufacturer. A specific answer regarding this can only be given on a case-by-case basis. PIN codes or passwords will only be bypassed where absolutely necessary to progress the investigation."
Deputy Chief Constable Malcolm Graham said officers are “committed to providing the best possible service to victims and witnesses of crime”.
He said: “This means we must keep pace with society. People of all ages now lead a significant part of their lives online and this is reflected in how we investigate crime and the evidence we present to courts.
“Many online offences disproportionately affect the most vulnerable people in our society, such as children at risk of sexual abuse, and our priority is to protect those people.
“Increases in the involvement of digital devices in investigations and the ever-expanding capabilities of these devices mean that demand on digital forensic examinations is higher than ever.
“Current limitations, however, mean the devices of victims, witnesses and suspects can be taken for months at a time, even if it later transpires that there is no worthwhile evidence on them.
“By quickly identifying devices which do and do not contain evidence, we can minimise the intrusion on people’s lives and provide a better service to the public.”
Cyber kiosks used by Police Scotland will not be enabled to store data from digital devices and that, once an examination is complete, all device data will be securely deleted from the kiosk.
Police Scotland emphasised that in the majority of cases the devices will be used to retrieve data from phones and laptops belonging to the victims of crime, so they can be returned faster.
The Scottish Police Authority paper said: “It remains the opinion of some agencies including Scottish Human Rights Commission and Privacy International that the legal basis for device examination is not sufficiently clear, foreseeable or accessible and new legislation is required. It is anticipated that representation will be made by agencies and some members of the External Reference Group to the Scottish Parliament, Justice Sub-Committee on Policing requesting a review of the law.”
But it adds: “Police Scotland is confident that existing law supports the use of digital triage devices. This is articulated in the Legal Basis document and confirmed by COPFS in their written submissions to the Justice Sub Committee on Policing”.
Holyrood Newsletters
Holyrood provides comprehensive coverage of Scottish politics, offering award-winning reporting and analysis: Subscribe