Police 'cyber kiosks' should be delayed over legal snag, MSPs recommend

The rollout of technology allowing police to gather data from digital devices without using a password should be delayed, MSPs have said.

Last year, Police Scotland purchased 41 "cyber kiosks" - laptop-sized machines that are able to bypass encryption on devices such as mobile phones so personal data can be read quickly.

It was intended the machines would start being deployed to police stations across Scotland from autumn last year.

Police have so far been unable to use them due to a lack of clarity about the legal basis for them.

The Justice Sub-Committee on Policing at the Scottish Parliament has been scrutinising the proposed use of the devices since last May.

In a report published on Monday, MSPs recommended the scheme should be paused until greater clarity on the legal framework for their use is provided.

The report was also critical of both the Scottish Police Authority (SPA) for a lack of effective scrutiny and oversight and Police Scotland for not following best-practice prior to using the devices on a trial basis before deciding to roll out their use across Scotland.

The committee found that during trials, police in Edinburgh and Stirling searched the mobile phones of suspects, witnesses and victims without undertaking the required governance, scrutiny and impact assessments.

Members of the public whose phones were seized and searched were also not made aware their phones were to be searched using cyber kiosks as part of a trial.

They were also not told about the implications of the search and were not provided with the option of giving their consent.

Justice Sub-Committee convener John Finnie said: "The sub-committee fully supports Police Scotland's ambition to transform to effectively tackle digital crime.

"However, prior to the introduction of any new technology to be used for policing purposes, an assessment of both the benefits and the risks should have been carried out.

"It appears that, in relation to the introduction of cyber kiosks, only the benefits were presented by Police Scotland to the SPA, with the known risks not provided.

"The SPA, for its part, seems to have accepted the information provided with very little critical assessment.

"Even the most fundamental questions, such as the legal basis for using this technology, appear to have been totally overlooked.

"This sub-standard process has resulted in over half a million pounds worth of equipment sitting gathering dust.

"Clearly, this is not an acceptable situation. The sub-committee wants to work with the Scottish Government and the stakeholder groups belatedly assembled to consider the implications of introducing cyber-kiosks to find a solution which would provide the necessary safeguards for the use of this new technology."

Mr Finnie added any future trials on the use of the machines must be greatly improved.

He said: "While the events related to the trials are in the past, the sub-committee remains concerned that this technology was used by frontline officers without any human rights, equality or community impact assessments, data protection or security assessments, and in the absence of any public information campaign.

"That approach is harmful to the reputation of Scotland's police service and potentially very serious for any victim, witness or suspect impacted by this.

"Any future trials must be carried out to a far higher standard, with more due diligence and forethought."

Assistant Chief Constable Steve Johnson of Police Scotland said: "Like the Justice Sub-Committee on Policing, we have received written confirmation from the Crown Office and Procurator Fiscal Service about the clear legal basis, and robust statutory regime, for the use of this much-needed technology.

"The rigorous scrutiny of this process by the Justice Sub-Committee has added significant value to the development of Police Scotland's assurance and governance processes for the use of this necessary equipment.

"As the Chief Constable has already made clear, there is a policing imperative for deploying the equipment to protect vulnerable victims and bring offenders to justice.

"However, he has also stated that he must be satisfied that privacy and human rights considerations have been transparently and satisfactorily addressed."

He added: "The value of cyber kiosks in helping protect the most vulnerable people in society while tackling the most highly-sophisticated criminality cannot be underestimated."

A Scottish Government spokeswoman said: "The recommendations in this report are principally for Police Scotland and the Scottish Police Authority to action, but the Scottish Government will give the report due consideration in the coming weeks.

"The Policing 2026 strategy emphasised Police Scotland's commitment to improving its cyber-capability and we welcome their ongoing commitment to further consultation with stakeholders as part of this process."

Susan Deacon, SPA Chairwoman, said: "The Committee's consideration of this issue has been informative and the SPA will consider the report carefully and respond in due course.

"The SPA has already strengthened our arrangements for the oversight of policing policy and practice and will continue to do so."

She said the SPA recognised that the proposed rollout has raised concerns regarding privacy, human rights and other legal and ethical matters.

She has asked the Chief Constable to provide a further report to the SPA Board regarding his proposed plans for the rollout in light of the concerns raised.