Police urged to halt rollout of mobile data harvesting

The rollout of technology allowing police to gather data from digital devices without using a password should be delayed, MSPs have said. Picture: Philip Toscano/PA Wire

Cyber-kiosks are laptop-sized machines which allow police to bypass encryption to read data such as text messages, e-mails and browsing histories from the phones of suspects, victims and witnesses.

The national force accessed hundreds of phones and SIM cards during a pilot in Edinburgh and Stirling between 2016 and 2018.

But Holyrood’s justice-sub committee on policing has urged Police Scotland to delay a national rollout of the technology amid concerns over its legality.

Committee convener John Finnie, a former police officer, said: “Prior to the introduction of any new technology to be used for policing purposes, an assessment of both the benefits and the risks should have been carried out.

“It appears that in relation to the introduction of cyber-kiosks, only the benefits were presented by Police Scotland to the Scottish Police Authority (SPA), with the known risks not provided.

“The SPA, for its part, seems to have accepted the information provided with very little critical assessment.

“Even the most fundamental questions, such as the legal basis for using this technology, appear to have been totally overlooked.”

Police Scotland spent £444,821 on the devices – just under the £500,000 threshold at which the force requires authorisation from the SPA.

The MSPs found that during trials police searched the mobile phones of suspects, witnesses and victims without undertaking the required governance, scrutiny and impact assessments. People whose phones were seized were not made aware their devices were to be searched using cyber-kiosks and were not provided with the option of giving their consent.

Assistant Chief Constable Steve Johnson said: “Like the justice sub-committee on policing, we have received written confirmation from the Crown Office and Procurator Fiscal Service about the clear legal basis, and robust statutory regime, for the use of this much-needed technology.

“As the chief constable has already made clear, there is a policing imperative for deploying the equipment to protect vulnerable victims and bring offenders to justice.

“However, he has also stated that he must be satisfied that privacy and human rights considerations have been transparently and satisfactorily addressed.”

Susan Deacon, chair of the SPA board, said she had asked the chief constable to provide a report on the rollout in light of the concerns raised.