98
IPCO Annual Report 2017
14.36
As a result of these sometimes acute problems, in 2017 our inspectors maintained particular
focus upon IPAR.
Interpretation of data
14.37
Acquiring communications data from a variety of different sources and systems
has become a frequently complex task. 7 of the 10 investigations related to the
misinterpretation of source data containing the target communications address prior to
the acquisition-process commencing (for example the applicant specified the wrong time
a suspect was using an IP address because they misunderstood what had been reported
to them). In three investigations the officer failed to understand the process by which IP
addresses are assigned and reassigned, and as a result there was focus on the wrong date
and time.
14.38
In two investigations, open-source research linked incorrect profiles to the incidents, and
in a further case an interpreter provided the wrong time for a particularly crucial relevant
telephone call.
14.39
Six search warrants were executed without justification in a single investigation because data
was misinterpreted, leading to the incorrect conclusion that particular individuals had shared
illegal files.
14.40
In another investigation, the error was the result of the incorrect way in which the IP address
and its associated time and date had been set out in the application.
14.41
In two investigations, accurate requests were made to different CSPs. However, there were
flaws in the subsequent manual searches to locate the relevant details, leading to the return
of incorrect information.
Lack of corroboration
14.42
Whenever possible, those conducting an investigation in this context should seek to
corroborate the IP activity which appears to reveal an offence. When a person is suspected
of sharing illegal material, the systems public authorities use to identify this offence will
usually capture the person’s internet activity over a number of days. Analysing a ‘spread’
of an individual’s online behaviour (often involving different IP addresses) will help confirm
whether the correct account has been identified.
14.43
We are pleased that there has been a notable increase in the number of IPARs that are being
submitted to provide corroboration for individual investigations.
14.44
In two investigations, in each of which a single customer account was being sought,
the investigating officers were undeterred when two different customer accounts were
returned. This should have halted both investigations because it was highly likely there had
been human error when entering the information (unless there was a connection between
the two accounts, which was not the position in either case). As a result, action was taken
against households the members of which had no involvement in criminality.
14.45
Members of the same household will frequently share passwords for ‘routers’ and this poses
a problem when investigators are seeking to identifying the device that is being used by
a suspect.