MSPs call for halt on cyber-kiosks

Cyber-kiosks, or ‘digital triage devices’, are laptop-sized machines that allow officers to bypass encryption to quickly read personal data from digital devices such as mobile phones or laptops. 

Police Scotland has 41 of these devices, which it had intended rolling out to police stations across Scotland from the autumn of 2018. 

However, officers have been unable to use them due to the lack of clarity about the legal basis for their use. Concerns have been extensively covered through scrutiny carried out by the Scottish Parliament’s Justice Sub-Committee on Policing, which has been investigating cyber-kiosks since May 2018. 

In a new report, the justice sub-committee criticised the Scottish Police Authority (SPA) for a lack of effective scrutiny and oversight, and Police Scotland for not following best practice prior to using these devices on a trial basis and then deciding to roll-out their use across Scotland. 

It says during the trials, officers in Edinburgh and Stirling searched the mobile phones of suspects, witnesses and victims without undertaking the required governance, scrutiny and impact assessments. Members of the public whose phones were seized and searched were not made aware that their phones were to be searched using cyber-kiosks as part of a trial, the implications of this, and were not provided with the option of giving their consent. 

The sub-committee is also asking the Scottish government to consider its findings and to provide clarity on the legal position of cyber-kiosks. 

Cyber-kiosks were introduced as part of Police Scotland’s Policing 2026: Serving a Changing Scotland programme of work. 

They are designed to increase the cybercrime digital forensic capabilities of Police Scotland by offering a triage point in the examination process. Seized mobile devices include those handed over voluntarily by victims and witnesses, as well as those obtained under the authority of a judicial warrant, statutory power or following a suspect’s arrest. 

At the time of their launch, Steve Johnson, assistant chief constable specialist crime and intelligence, said the cyber kiosks would provide “specially trained officers with the ability to triage lawfully seized devices, reducing the number which are required to be forensically examined, and reducing the inconvenience to a witness or victim of retaining a device which, on later examination, has no evidential value”. 

“No data is retained by the kiosk. In situations where a large amount of specific data from set parameters is available, the device has the capability to copy this to an encrypted disc for later viewing,” he added. 

However, Police Scotland Chief Constable Iain Livingstone acknowledged at a meeting of the Justice Sub-Committee on Policing in January that “there was a failure to fully assess and communicate what we were seeking to do with the capability that we are looking to introduce”. 

He told the sub-committee: “There is barely an incident that we respond to that does not feature a mobile device, simply because of how people live their lives. 

“[However], the work has been paused, and I was keen for that to be done. There was an acknowledgement that we did not reach out as broadly as we could have done and did not absolutely establish and articulate the clear legal and rights-based authority for the use of the equipment. We also did not fully articulate the benefits and the ethical priority for introducing the equipment. 

“All that caused a loss of confidence… We have not just ploughed on and ignored the feedback; the roll-out has been delayed until a number of key issues are addressed.” 

Speaking as the report was launched, justice sub-committee convener, John Finnie MSP, said: it “fully supports Police Scotland’s ambition to transform to effectively tackle digital crime”. 

“However, prior to the introduction of any new technology to be used for policing purposes, an assessment of both the benefits and the risks should have been carried out,” he added. 

“It appears that, in relation to the introduction of cyber-kiosks, only the benefits were presented by Police Scotland to the SPA, with the known risks not provided. The SPA, for its part, seems to have accepted the information provided with very little critical assessment. 

“Even the most fundamental questions, such as the legal basis for using this technology, appear to have been totally overlooked. 

“This sub-standard process has resulted in over half a million pounds worth of equipment sitting gathering dust. 

“Clearly, this is not an acceptable situation. The sub-committee wants to work with the Scottish government and the stakeholder groups belatedly assembled to consider the implications of introducing cyber-kiosks to find a solution which provides the necessary safeguards for the use of this new technology.” 

Mr Finnie added that while the events related to the trials were in the past, the sub-committee remains concerned that “this technology was used by frontline officers without any human rights, equality or community impact assessments, data protection or security assessments, and in the absence of any public information campaign”. 

“That approach is harmful to the reputation of Scotland’s police service and potentially very serious for any victim, witness or suspect impacted by this. Any future trials must be carried out to a far higher standard, with more due diligence and forethought,” he said. 

The Scottish Human Rights Commission says it is pleased that Police Scotland has recognised the need to have clear legal authority to use cyber kiosks. 

Chair Judith Robertson said: “The Commission has previously given the Scottish Parliament its view that there is a lack of clarity about the precise legal basis for the use of this technology, as well as an absence of sufficient oversight safeguards. 

“As mobile phone browsing can be highly intrusive of the right to privacy, home and correspondence it is essential the necessary safeguards are in place to regulate its use.”