50
IPCO Annual Report 2017
8.8
Not all of the statutory purposes are available to all the public authorities (see Statutory
Instrument No. 480 of 2010). For example, it is only the Commissioners of HMRC who may
acquire data to exercise the functions relating to the assessment and collection of taxes
or duties, and acquiring data to assist investigations into alleged miscarriages of justice is
restricted to the Criminal Cases Review Commissions in England and Wales, and Scotland.
8.9
Typically public authorities will acquire data directly from the large CSPs, but with the
required authorisation they can equally acquire it from smaller businesses or entities such
as hotels, restaurants, libraries and airport lounges, to the extent that they provide their
customers or users with communication services.
Use of the powers
8.10
Communications data is used for a wide range of enquiries, to identify for instance who was
using a particular communications device, where the users were located, with whom they
were in contact or the time and duration of the communications.
8.11
It is useful in this context to provide some examples:
Law enforcement
• A police child-sexual-exploitation team responded to a primary school’s report that a ten
year old pupil had sent indecent photographs of herself on a social media application
to a person purporting to represent a modelling agency. Investigators acquired items of
internet data to identify the address from which the bogus social media account had been
set up. The data enabled the investigators to identify particular premises where the police
arrested the offender and seized his telephones and computers. A forensic examination of
these devices identified other bogus social media accounts from which the offender had
contacted over 100 children. He was subsequently charged with online grooming and the
possession and distribution of sexual images of children.
• A law enforcement agency investigated the human trafficking of non-EEA nationals from
the UK to other EU member states. Police officers intercepted a trailer which was being
used to transport foreign nationals to Dover. Data that was acquired relating to the
driver’s telephone led to the identification of others who were involved with organised
trafficking offences and the locations which were key to the criminal enterprise.
Use by regulators
• The Financial Conduct Authority investigated a ‘boiler room scam’ whereby fraudsters
deceived victims into investing in shares by intentionally inflating and overstating the
potential of the proposed investments. The criminal proceeds for these offences were
just under £5 million. The ‘boiler room’ employed 25-30 staff to ‘cold-call’ prospective
investors. Data from 63 RIPA approved applications corroborated the victims’ accounts.
Internet Protocol (IP) data acquired from the server hosting the fraudsters’ websites
identified the offices from which telephones and computers were seized and at which the
offenders were arrested. Eight defendants were sentenced to a total of 34 years in prison.