PSNI officer receives final written warning after copying entire contents of missing person’s laptop

The search took place in May 2022 when investigators arrested the officer, who was at that stage suspected of committing an unrelated criminal offence.

A number of USB sticks recovered during the search were submitted for forensic examination.

Two were found to contain software used to allow computer password protection to be bypassed, one of which also contained a complete backup of a laptop belonging to an elderly missing person.

The computer had been seized by the officer in January 2019, when he had been working on the related PSNI missing person investigation.

The backup of its contents included sensitive personal information such as bank details and legal documents.

The Police Ombudsman’s chief executive, Hugh Hume, said the officer’s actions represented a “serious breach” of police procedures for the protection of personal data.

“While the officer used some of the information to assist police efforts to locate the laptop’s owner, it is frankly shocking that the entire contents of the laptop were found on an unsecured USB stick in the officer’s home three years after he ceased to have any involvement in the case,” he said.

“We take the protection of personal data extremely seriously. Any misuse of sensitive information by those entrusted to uphold the law undermines public confidence and violates the principles of integrity and accountability.

“PSNI need to ensure they have effective control measures in place to manage the integrity of electronic devices seized by police. We will be sharing our findings with the Information Commissioner’s Office to inform their inspection and oversight in this critical area.”

The Police Ombudsman’s investigation found that by the time the officer sought permission to access emails on the laptop as part of the missing person investigation, he had already bypassed its security and downloaded its entire contents.

He did this using software and USB sticks he had obtained privately, instead of submitting the laptop to the PSNI’s Cyber Crime Centre in line with police policy and procedures.

The officer seized the laptop on January 8, 2019, after being tasked by a senior officer to retrieve it for safekeeping from the missing person’s isolated and unoccupied home.

A forensic examination of the machine undertaken during the Police Ombudsman’s investigation showed that it had been switched on two days later, when a USB stick was inserted and a new user account called PSNI was created.

On January 13, 2019, a different USB stick was plugged in, the PSNI account was deleted and the machine’s passwords were changed before the entire contents of the computer were copied to the memory stick.

The following morning the officer made an enquiry with a business in the Republic of Ireland based on information retrieved from the computer.

Three minutes after making a note of this enquiry, the officer was tasked to check if it was possible to examine outgoing emails on the device, said the Police Ombudsman. He responded to check that he had permission to access the emails – despite having already copied the entire contents of the machine.

Inquiries by Police Ombudsman investigators also found that after seizing the laptop, the officer took 36 days to lodge it in the PSNI property store. He made no record on police systems about its location in the interim.

The Police Ombudsman submitted a file to the PSNI recommending that the officer had a case to answer for gross misconduct.

This was accepted by the PSNI and at the subsequent misconduct hearing the officer said he had been genuinely concerned for the missing person’s welfare.

He added that he had not submitted the computer to the Cyber Crime Centre to avoid delay, and said he thought that the data had been removed from the USB stick.

While the misconduct panel accepted that the officer had been concerned for the missing person, it also noted that his actions had been “deliberate… and had continued for a number of days with repeated access to the laptop computer”.

It concluded that he had committed gross misconduct, given that he had:

• Obtained personal data in a way which failed to respect the right to private and family life set out in the European Convention on Human Rights;
• Failed to ensure that property entrusted to his care was stored appropriately; and
• Had acted in a way likely to bring discredit to the police service.

In the circumstances, the panel found that a final written warning was the appropriate sanction.

The separate investigation, which led to the discovery of the USB memory sticks, resulted in the Police Ombudsman’s Office submitting a file to the Public Prosecution Service (PPS) in relation to the suspected offence of misconduct in public office.

The PPS subsequently directed that the officer should not be prosecuted, after which the Police Ombudsman submitted a misconduct file to the PSNI’s Professional Standards Branch (PSD).

The misconduct process remains ongoing.

The Police Ombudsman’s Office said the owner of the laptop has never been located and remains a high-risk missing person.

Detective Superintendent Julie Mullan of the PSNI’s Professional Standards Department said: “The Police Service and the public expect police officers to investigate incidents fully, fairly and professionally.

“Where it is perceived that conduct falls short of these high standards, it is right that officers should face an impartial, thorough enquiry by the Police Ombudsman’s office.

“The Police Service has accepted the findings of the Ombudsman in this case and implemented an internal disciplinary process which resulted in a final written warning to the officer concerned.

“While in this instance the conduct of the officer fell short of the standards that we have set, it is not representative of the excellent work police officers carry out across Northern Ireland on a daily basis as we strive to keep people safe.”