Rollout of technology to hurt cyber crime slowed down by Parliamentary scrutiny

The force intends to use the introduction of 41 cyber kiosks as a triage point for frontline officers in the examination process, targeting data held on a smart phone instead of having to analyse the full contents.

The national force is confident the technology – which allows the circumventing of passwords and other security measures – reduces a build-up of devices pending scrutiny as ‘specially trained’ officers will “only be looking to attain specific information relative to offences under investigation”.

The planned rollout was halted last month when it emerged trials were held in Edinburgh and Stirling before human rights, data protection and privacy assessments were carried out.

The force, which has spent more than £370,000 on the cyber kiosks manufactured by Israeli vendor Cellebrite and supplied by IT reseller Insight, was then hauled before MSPs at the Scottish Parliament and told to carry out a consultation amid privacy concerns.

Police Scotland is now carrying out an Equality and Human Rights Impact Assessment, a Privacy Impact Assessment, and a Data Protection Impact Assessment (DPIA), with the aim of ensuring use of the devices complies with new General Data Protection Regulations which came into force last week. It is also working on a code of practice to be written up by the autumn.

Despite the hold-up, Assistant Chief Constable Steve Johnson says the force is still within the “procurement phase” and accepts it will be “some months” before kiosks will be used by frontline officers.

He added: “While we are confident the ability to triage devices legally seized by police, under warrant or legal powers, will deliver a much better service to the public, we understand the importance of providing assurance around the legal basis for using kiosks, privacy protection and good data security.

“We are keen to consult and work with a range of stakeholders to develop this assurance.

“We are currently developing the policy and guidance for frontline officers and working closely with our information management teams to ensure this addresses any public concern and meet the standards expected of Police Scotland.”

Among the capabilities offered by the kiosks is an option to download everything held on a smart phone to an encrypted disc.

But Police Scotland maintains that if no crime is detected on any of the 15,000 devices expected to be seized by officers this year, it can be returned with “relative speed”.

Mr Johnson told Police Professional: “It is similar to the seizing of any other device except this initial view of data is made simple by the use of the technology and takes less time, which vastly frees up resource.”

At the moment devices can only be searched if officers have seized them “under the execution of a warrant or other statutory powers”. They are then sent to one of five cyber hubs –in Inverness, Aberdeen, Dundee, Edinburgh and Glasgow – where specialist officers can access them. But the process can take weeks.

But using the new technology as a triage point in the examination process “will be highly beneficial to Police Scotland and the public as it targets data held on a device instead of analysing a full device”, added Mr Johnson.

“It reduces a build-up of devices pending examination as the specially trained officers will only be looking to attain specific information relative to offences under investigation.

As part of the Policing 2026 plan, the force hopes to rebalance the workforce – recruiting more specialist staff with cyber expertise to increase operational capacity in the later stages of cyber forensic analysis.

Change is on the way across the UK. Policing and fire service minister Nick Hurd has challenged forces to embrace technology, describing it as “absolutely essential” for modern frontline policing.

Last July, the Metropolitan Police Service agreed to a digital forensics-managed service from cohort company MASS as part an £8 million deal until 2024 with the option of a three-year extension that also allows other forces and agencies to join the partnership should they wish to do so.

It is part of a strategic partnership model developed by the MPS’s digital, cyber and communications unit that will create managed digital forensic kiosks across the force where officers can carry out examinations of seized devices.

Previously, digital forensics was carried out in-house, but was constrained by a centralised system in which devices were sent to a central laboratory.