Should police be allowed to forensically search mobiles?

A Police Scotland bid to use cyber kiosks to gather data from mobile devices has been delayed amid concerns the technology may be unlawful.

The force has invested thousands of pounds on the state-of-the-art devices, which can override passwords, and had planned to deploy them across the country from next month.

But experts claim the kiosks may contravene European law.

The kiosk is a desktop personal computer designed and equipped with software solely for the examination of mobile data devices.

The technology was trialled in both Edinburgh and Stirling in 2016 using phones and SIM cards which had been legally seized by frontline officers.

In normal circumstances the devices would have been sent away to the nearest Cyber Digital Forensics team for analysis, a process that can take weeks

The trial did not collate the evidential value of the examinations as that was not in its remit.

An advert for a similar portable device, manufactured by Cellebrite, states its purpose is to "extract evidentiary data in a forensically sound manner".

The technology allows officers to circumvent passwords or other security measures to access and extract data stored on mobile devices suspected of being used in cyber crime.

The commercial, which features a Hollywood-style voiceover, claims: "Cellebrite makes digital data more accessible, more intelligent and more actionable than ever before.

"Wherever there is crime or terror we're there."

Phones now form a vital part of criminal investigations and forensic experts examine about 15,000 a year.

This is a labour intensive and time consuming process and it can take weeks to reunite people with their devices.

Seized units will include those handed over voluntarily by victims and witnesses, as well as those obtained under the authority of a judicial warrant, statutory power or following a suspect's arrest.

In a submission to the justice sub-committee on policing Supt Nicola Burnett said the technology allowed officers to fast track investigations in the digital age.

The officer also said the kiosks allow evidence to be captured swiftly.

She concluded: "It is imperative that Police Scotland embraces new technology to advance how we investigate crime and keep people safe."

Some experts fear giving officers the ability to bypass passwords on mobile phones to access data could be against the law.

The sub-committee heard significant concerns about the legal basis for the kiosks' use from both the Information Commissioner's Office and the Scottish Human Rights Commission.

They focused on the right to privacy, the type of personal data that can be accessed - such as biometric data - the legal basis for accessing it, and arrangements for data security.

Clare Connelly, of the Faculty of Advocates, does not believe the introduction of cyber kiosks is legally justified.

She said: "We require an overview and a review of the laws around the search of all electronic devices and we need to make sure that that law matches modern technology and the conventions and privacy rights that individuals have.

"The proposed introduction of cyber kiosks has opened something of a Pandora's Box.

"The laws we have that govern search under statute were designed and passed at a time when the world was a very different world and storage of information was very different."

Ms Connelly said there real concerns over whether the gathering of data complies with Article Eight of the European Convention.

She also told BBC Scotland that while searches for cases involving child exploitation online involve scanning images stored on a device's memory, cyber kiosks can scan a "much wider spectrum of information".

Ms Connelly added: "Therefore being able to curtail searches to make sure that the police only look at what they are looking for is extremely difficult."

David Freeland, senior policy officer at the Information Commissioner's Office, told MSPs the legal basis was "not sufficiently clear".

He said: "I'm not an expert in criminal law and we do need Police Scotland to spell out in this case what that is.

"Until that is there we can't be clear that it's lawful."

How has Police Scotland responded?

Det Ch Supt Gerry McLean, the force's head of organised crime and counter terrorism, said the kiosks were an invaluable tool.

He said: "What we are trying to do is give a better service to the public, to frontline officers and to the many people we come into contact with, day in and day out, when we are investigating crimes.

"We take their devices and it is some months before we are able to return them to them."

Mr McLean said the device can quickly establish if a phone is relevant to the matter under investigation.

Asked if it can bypass passwords, he replied: "It has some capability to get past some of the security measures within smart phones but as technology changes that becomes limited."

Mr McLean said less than 10% of the smart phones examined by police are needed for the crimes under investigation

On the legality of the cyber kiosk devices, he said: "We have a confidence and assurance about the legal basis.

"Those are laws that are usually conferred on us by a warrant issued by the court or on some statutory provisions on us.

"What that basically means is a law provided to the force through the Criminal Justice Act in Scotland that allows us to search people and seize items if they have been arrested for a crime."

Mr McLean said the policing landscape in Scotland was now "very complex" due to advances in technology.

Police Scotland had hoped to start using cyber kiosks next month but the force is now unable to put a timeline on the launch.

The Crown Office has yet to announce the legal position and the debate seems destined to run well into 2019.

John Finnie, chairman of the justice sub-committee on policing, said it would now prepare a report for justice secretary Humza Yousaf based on the evidence it has heard

He confirmed the committee would also seek a response from Police Scotland Chief Constable Iain Livingstone.

As it stands, Mr Finnie said: "There is not a sound basis for Police Scotland to roll out this programme."

He also said the law must prevent the force examining phones "simply on a fishing exercise" and said lessons could be learned from the row surrounding stop-and-search.

Mr Finnie added: "Everything suggests there should be a code of practice put in place in respect of this.

"Longer term we need to look at legislative changes because the technology that we all carry around in out pocket contains a wealth of information.

"The last thing anyone wants is any collateral intrusion."