106
Investigatory Powers Commissioner’s Annual Report 2019
matter, following these policies would likely result in a reportable error. In many of the
authorities we inspected, the RIPA policy also fails to set out clear guidelines on the use of
CHIS. It is common for councils to express a view that they would not consider using CHIS
because they perceive the authorisation processes to be complex and risky. Establishing
clear processes for the authorisation and use of CHIS in policy and supporting this
through the provision of scenario-based training, helps to allay these fears and familiarise
investigative staff with the full array of covert tactics available for their use.
Figure 16: CHIS authorisations for 2017 to 2019
50
45
44
40
35
36
35
2018
2019
30
25
20
15
10
5
0
14.8
2017
Conversely, we commonly recommend that RIPA policies should contain guidance to ensure
that daily interaction by council staff with members of the public does not inadvertently
stray into CHIS territory. For example, where a member of the public makes a complaint
about antisocial behaviour, they should not be asked to utilise a relationship covertly to
obtain information about possible criminal offences because this amounts to the tasking
of a CHIS.
Internet and social media
14.9
The use of the internet and social media by local government has brought about the
increased risk that private information available online may be accessed for investigative
purposes. We encourage councils to use the internet as a legitimate information
source in a responsible and structured manner. Each council’s RIPA policy should
clearly state the limitations in place on the use of information found on the internet for
investigative purposes.
14.10
One council we visited during 2019 had undertaken a comprehensive audit of its internet
use before introducing a firewall preventing council staff from accessing social media
websites without first seeking permission and justifying their business need. While some
councils may see this step as an overzealous restriction, it does help limit the potential
for unregulated surveillance. It is not uncommon for council investigators to review online
information on a one-off basis to confirm or refute suspicions or allegations. Such a brief
review is unlikely to amount to surveillance, but we recommend that care should be taken
to ensure that all research, be it one off or on an ongoing basis amounting to surveillance,
is undertaken in a controlled manner and capable of being audited.