84
Investigatory Powers Commissioner’s Annual Report 2019
12.28
We generally found that forces were cancelling authorisations when they were no longer
necessary, and we saw an increase in the number of verbal cancellations being given with
associated paperwork completed and submitted in a timely manner thereafter. In a small
number of forces, there was a delay when submitting the written paperwork. The majority
did not include any instruction by the AO as to who was responsible for the retention,
review or handling of any product obtained.29 We identified one notable exception, where
there was an excellent commentary provided in this area. As noted, we intend to conduct
an overarching review of data handling models over the next two years and would expect
to see improvements as a result (see chapter 7).
12.29
We have found that the review of applications and notifications by Judicial Commissioners
(JCs) allows for the identification of minor issues which we can raise with the originating
Forces in a process of continuous improvement.
12.30
Whilst the majority of law enforcement agencies use a variety of IT systems to maintain
records of applications and authorisations for surveillance, there are still some who
continue to use hard copy documents. We believe that IT systems ensure better oversight
and lessen the risk that documents could be illicitly amended at a later date. Where hard
copy records do exist there needs to be a totally transparent and auditable process to
ensure integrity of the documentation.
Legal professional privilege (LPP) material
12.31
There have been several cases where LPP material has been obtained and we have a
high level of confidence that this sensitive material was handled appropriately. However,
we found limited evidence that the likelihood, and necessity, of obtaining LPP was well
considered. It is usually unlikely that LPP or confidential material will be obtained, but we
have found an overreliance on this generality. Some forces have failed to document specific
considerations of cases where LPP could plausibly be obtained, for example when a subject
is being released from custody for questioning pending further investigation.
Targeted equipment interference (TEI)
12.32
The IPA introduced the requirement for LEAs to obtain warrants for conducting TEI in order
to obtain communications, private information or equipment data where to do so would
constitute an offence under the Computer Misuse Act 1990. This restricted LEAs’ ability
to use the pre-existing regime of seeking authorisation for property interference under
Part III of the Police Act 1997 for such activity. TEI covers interference with any equipment
producing electromagnetic, acoustic or other emissions; in more simple terms, this means
desktop computers, laptops, tablets, smart phones, other internet-enabled or networked
devices and any other devices capable of being used in connection with such equipment.
Interference with equipment was not new to law enforcement, although the IPA warrant
authorisation process and associated documentation was entirely new.
12.33
Prior to the implementation date for LEAs on 5 December 2018, they undertook a national
programme of training delivered by the Home Office and the National Police Chiefs Council
(NPCC). This ranged from formal online training modules for operational officers to staff
awareness and familiarisation sessions delivered at a local level. In most cases, the training
29 Chapter 9 paragraphs 9.1-9.6 of the 2018 Covert Surveillance and Property Interference Code of Practice
set out requirements for handling and safeguarding data obtained under surveillance and property
interference authorisations.