Information Tribunal Decisions re IMSI Catchers: A loss for transparency and why we will continue the fight through other means

In December 2019, the Information Rights Tribunal issued two disappointing decisions refusing appeals brought by Privacy International (PI) against the UK Information Commissioner.

The appeals related to decisions by the Information Commissioner (IC), who is responsible for the UK’s Freedom of Information regime, concerning responses by the Police and Crime Commissioner for Warwickshire and the Commissioner of Police for the Metropolis (The Metropolitan Police) to PI’s freedom of information  requests about police use of IMSI catchers. IMSI catchers are a type of surveillance technology that can capture information about the mobile phones in use in a particular area.

The IC deemed the police forces freedom of information responses generally sufficient, and most troublingly, allowed a number of police forces to maintain a neither confirm nor deny (NCND) position in relation to whether they used IMSI catchers. The Warwickshire and Metropolitan Police cases were the lead of a set brought by PI in relation to similar decisions and responses by other law enforcement agencies, the others of which were stayed pending these decisions and have since been withdrawn.

Given the public importance of transparency regarding the use of new policing technology, especially when it can be used for mass surveillance, PI is frustrated by many aspects of these judgments. However, for the reasons set out in this piece, we have decided not to appeal these decisions. We will continue to campaign for more transparency and safeguards on the use of IMSI catchers as part of our work challenging mass surveillance.

Background

This case stems from a series of freedom of information (FOI) requests submitted by PI in November 2016 to various police forces*, the Home Office and the National Police Chiefs’ Council seeking records related to UK police purchase and use of IMSI catchers. PI submitted the requests following an October 2016 article by The Bristol Cable citing to evidence that a number of police forces purchased “Covert Communications Data Capture Equipment”, which from the available information was understood to be a reference to IMSI catchers. This reporting informed to which forces PI then sent FOI requests.

IMSI catchers are a type of mobile phone surveillance technology, which mimic mobile phone base stations in order to trick all mobile phones within a particular radius to connect to them and transmit their locations and identifying information. A detailed description can be found in this witness statement prepared as part of PI’s case. Because IMSI catchers can be used to capture information on all phones in a particular area, indiscriminately, they can be used as a form of mass surveillance.

All of the bodies refused every category of the FOI requests. The majority asserted that they could “neither confirm nor deny” whether they held information responsive to the request. Warwickshire and West Mercia confirmed holding a business case, given that they had inadvertently published the minutes of a meeting between them, revealing the existence of a business case (reported on by Bristol Cable). However, both bodies applied exemptions to withhold the case itself. PI challenged the bodies’ reliance on NCND and their application of exemptions by requesting an internal review. Upon internal review, each of the bodies upheld their initial decisions. PI then challenged those decisions by appealing to the IC.

In July 2018, the IC issued its decisions. The IC agreed with PI that the police bodies could not rely on an NCND position to refuse FOI requests for the following categories of records: legislation, codes of practice, and marketing or other promotional materials related to IMSI catchers. These categories were deemed not to reveal whether police had bought or used IMSI catchers, and legislation and codes of practices should be publicly available anyway. The IC was also critical of the “blanket fashion” in which the authorities responded, together with the various procedural failings. However, the IC upheld the police forces’ NCND position for the remaining categories of records requested by PI, which included internal policy guidance as well as contracts and other records regarding the purchase of IMSI catchers. It also upheld the two bodies' reliance on exemptions to withhold the business case relating to the purchase of IMSI catchers.

In August 2018, PI, represented by Liberty, appealed these parts of the IC’s decisions to the First-Tier Tribunal. The case was heard before the Tribunal in August 2019. The case challenging the Metropolitan Police’s FOI response was the lead case in relation to the NCND responses by the bodies. The case against the Warwickshire Police and Crime Commissioner’s response was the lead case for the Warwickshire and West Mercia’s refusal to disclose the business case.

The Decisions

In December 2019 (with the corrected versions issued in February 2020), the Information Rights Tribunal issued its decisions in the two lead cases:

Metropolitan Police Decision

This decision concerns PI’s appeal against the IC upholding the Metropolitan Police’s NCND of the information, citing exemptions in s.23(5) and s24(2) of the Freedom of Information Act 2000 (FOIA).

Section 23(5) of FOIA permits bodies to NCND holding information, if, or to the extent that, not doing so would involve disclosure of any information which was directly or indirectly supplied by or relates to, bodies dealing with security matters. There is an exhaustive list of such bodies, including GCHQ, MI5, MI6 and the National Crime Agency. Section 24(2) of FOIA permits bodies to NCND holding information to the extent that it is required for safeguarding national security. Before the Tribunal, the Metropolitan Police also sought to rely on section 31(3) of FOIA which permits bodies to NCND holding information, if not doing so would or would be likely to prejudice law enforcement.

PI's arguments

PI challenged the reliance on these exemptions. We argued that the IC erred in its interpretation of section 23(5) and that the words “relates to” should be given a narrow construction. Our concern was that this exemption was being applied extremely broadly, because the requests relate to a covert technique, which could relate to the security services/ be in the ambit of the security services. A broad application is particularly concerning given that this is an absolute exemption. We also argued that section 24(2) was not engaged, taking issue with the way in which the conclusion of harm to national security was reached and the lack of justification provided to us. The main assertion – that terrorists and criminals would be able to avoid detection if they knew of IMSI catcher use – was unconvincing because of other surveillance powers available to the police which would allow them to still detect serious crime. Furthermore, this reasoning hasn’t prevented the avowal of other surveillance methods, including mobile phone extraction and predictive policing, in the past. In relation to the Metropolitan Police’s reliance on section 31(3), we argued that this was unparticularised and unevidenced.

Furthermore, even if section 24(2) and 31(3) were engaged, we argued that the public interest in maintaining the exemption is outweighed by the public interested in confirming or denying that the requested information was held, in particular given the potential for arbitrary and indiscriminate use of this intrusive technology and the need for informed public debate. Such reasoning has implicitly been acknowledged in the avowal of other surveillance methods in the past, as noted above.

PI also sought to highlight the contradictory nature of continuing to NCND despite reporting and publication of documents. Our witness statement set out in detail information in the public domain about IMSI catchers, including public reporting about police force purchase and/or use of IMSI catchers, public reporting about IMSI catchers more generally, information about public authorities that have confirmed their purchase and/or use of IMSI catchers, and confirmation by police forces in the UK of purchase and/or use of other surveillance technology and disclosure of relevant records.  We were also supported in our arguments by evidence from experts at the ACLU in the US and GFF in Germany, where much more stringent transparency requirements relating to IMSI Catcher are in place. PI used this evidence to support our argument that more transparency is both possible and compatible with the protection of national security.

Tribunal’s conclusion

The Tribunal upheld the IC’s decision notice and refused the appeal.

We are particularly disappointed with the Tribunal's assessment of the evidence provided by PI, both in terms of the information in the public domain and comparative frameworks, as well as the heavy reliance on closed evidence, to which PI is not party.

In its decision, the Tribunal stated that they “found it difficult to assess the reliability of the considerable body of evidence relied on by PI as ‘being in the public domain’”. This is concerning, as in doing so the Tribunal dismisses reporting by a range of reputable and varied sources, including The Guardian, The Times, Sky News, the BBC, the Independent, the Telegraph, The Intercept, The Bristol Cable, Vice News and Motherboard. And if, as the Tribunal concluded, these cannot be considered sufficiently reliable sources on police use of technology, then there must be an even greater public interest in disclosing more reliable information through the FOI process.

In relation to section 23(5) the Tribunal accepted a tenuous link with the National Crime Agency and, relying on close evidence to which PI was not party, concluded that the requested information should be regarded as ‘related to’ the security bodies. The Tribunal noted that refusing disclosure of such information is a protective step to stop inferences being drawn.

The Tribunal accepted, relying on the closed evidence, that the section 24(2) exemption is engaged, given that to “safeguard” national security involved protecting the public from all threats and saving lives. This is disappointing as whilst we acknowledge that the term national security may encompass a range of threats, including terrorism and serious organised crime, this is an extremely broad approach with very little justification of why the exemption is engaged in this specific case.

The Tribunal, again relying on evidence provided in closed, found that the section 31(3) exemption is also engaged and that not maintaining the NCND stance would be likely to prejudice the prevention or detection of crime and the apprehension and prosecution of offenders. The evidence PI was able to see did nothing to allay our concerns regarding the unparticularised application of this exemption.

A challenge for PI throughout was the failure of the Tribunal and the parties (the IC and police forces) to provide any useful gist of the closed evidence/ submissions – which in turn is heavily relied upon by the Tribunal in its decision-making. Provision of a useful summary or ‘gist’ is supposed to be an important safeguard against closed justice, in particular where you cannot appoint a Special Advocate to represent you, such as in the Information Rights Tribunal.

On the balance of the public interest test, the Tribunal accepted the evidence of both police witnesses but held that:

We do not rely on the Appellant's un-evidenced assertion that greater transparency in other jurisdictions has not impacted negatively on policing or national security. We do not accept that the Respondents had a duty to rebut an un-evidenced assertion. It does not seem to us that this particular assertion is, in any event, likely to be capable of proof either way.

We are concerned that this attitude fails to critically engage with the evidence provided by PI about the transparency requirements and subsequent disclosures in both the US and Germany. It places a disproportionate and unnecessary burden on PI, as opposed to the police forces and IC, with no consideration as to why there is no similar level of transparency in the UK.

This aspect of the judgment also contradicts the Tribunal’s earlier reasoning. In balancing the public interest, the Tribunal says that it is impossible to prove that national security may be impacted (negatively or positively) by reporting on IMSI catchers. Yet the Tribunal’s approval of the assertion of NCND is underpinned by its acceptance of the police forces’ evidence that UK national security will be impacted by reporting on IMSI catchers. Leaving the question of, which is it: Impossible to prove? Or possible to prove and proven by the police here?

Finally, the Tribunal concluded that:

We accept the open evidence of DSU Williams and DSU Nolan that lives would be put in danger by the confirmation or denial of holding the information requested because if criminals or terrorists knew about the capabilities and location of covert technology, they would be likely to adjust their behaviour accordingly. We conclude that the acknowledged public interest in transparency does not outweigh such a weighty case for a NCND stance in these circumstances.

Again, the Tribunal’s disappointing conclusion fails to engage with the wide range of evidence and arguments put forward by PI in this case. The Tribunal’s approach, relying heavily on closed evidence, affords overly wide discretion to the Metropolitan Police and places an unrealistic burden on those seeking transparency regarding public use of and spend on mass surveillance equipment.

Police and Crime Commissioner for Warwickshire Decision

This decision concern’s PI’s appeal against the IC upholding Warwickshire Police and Crime Commissioner’s refusal to disclose. Two bodies, Warwickshire Police and Crime Commissioner (PCCW) and West Mercia Police and Crime Commissioner confirmed they held a business case relating to the purchase of IMSI catchers but they refused to disclose it due to the following exemptions: section 24(1) which exempts the disclosure of information if required for the purpose of safeguarding national security; and section 31(1)(a) and (b) which exempts the disclosure of information, if it would, or would be likely to, prejudice the prevention or detection of crime (31(1)(a)) or the apprehension or prosecution of offenders (s31(1)(b)).

PI’s arguments

PI challenged the reliance by PCCW on these exemptions. We argued that they were not engaged and that it had not been demonstrated sufficiently that they were.  Even if they were, the public interest in maintaining the exemptions would be outweighed by the public interest in disclosure of the business case.

On the point of the consequences of disclosure, it was interesting to note that during the cross-examination of DSU Nolan -  who had recently taken up the position of Head of Intelligence for Warwickshire Police – when questioned on the impact of the disclosure of the unredacted minutes (which led to the Bristol Cable reporting and PI’s initial FOIs) he confirmed, as cited in the Tribunal’s decision, that such disclosure “has not stopped anyone from doing their job”. This indicates that disclosure of information does not necessarily impede the operation of law enforcement.

Tribunal’s conclusion

The Tribunal upheld the decision notice and refused the appeal.

The Tribunal held that section 24(1) was engaged, based on the interpretation of “required” as “reasonably necessary” and similarly to the Metropolitan Police decision, that the term “national security” in the exemption encompasses a range of threats from which the public must be protected.

The Tribunal considered the information in the withheld business case versus the information in the public domain as they sought to understand what more the public would learn from the business case and what threat that would pose to national security. In doing so, the Tribunal again questioned the reliability of evidence provided in the public domain by PI, noting that the press reports cite unnamed sources or former officers. This is disappointing, as it seems to reinforce that a lack of transparency will perpetuate a lack of transparency and does not acknowledge the importance of these news sources. In any event, the Tribunal found that that the business case revealed information different to what is already in the public domain via both the minutes disclosed in error and generally. We have no more information about what this difference is, solely that the Tribunal accepted the evidence from the police witnesses and were satisfied that the national security exemption in section 24(1) was engaged.

In relation to the law enforcement exemptions in section 31(a) and (b), the Tribunal again accepted the evidence from the police, on the use information of the sort contained in the business case could be put to.

On the public interest test, the Tribunal concluded the public interest favours maintaining both the exemptions, accepting that “lives would be put in danger by the disclosure (including via a 'mosaic effect') of the information contained in the business case because if criminals or terrorists knew about the capabilities of covert technology, they would adjust their behaviour accordingly.”

We do not know the details of the evidence heard in closed or the type of information contained in the withheld business case, yet from what was revealed to us, we think this decision fails to fully interrogate the assertions made by law enforcement on the spend and use of equipment that can be used for mass surveillance.

Wider concerns regarding FOIA framework

PI brought this challenge, in part, due to our concerns with the broad and ‘knee-jerk’ application of NCND when information about police technology is sought. The police bodies responses were based on a broad interpretation of the exemptions relating to the security bodies, national security and law enforcement. Furthermore, their application of the public interest test, in our view, failed to give sufficient weight to the public interest in disclosure. Their approach to these requests is concerning in and of itself, but in particular, when requests relate to the use of covert technology like IMSI catchers which are highly intrusive, indiscriminate, and impact on a range of human rights, from privacy, to freedom of expression, to freedom of assembly and association. As we highlighted before the Tribunal, there is a public interest and demand for transparency on the use of such technologies and other countries, like the US and Germany, have frameworks in place to provide this.

Whilst we are disappointed with the judgments for the reasons set out above, we decided not to appeal. Although PI took this case given the potential that positive decisions would prompt wider change, the decisions as they stand are fact specific to the IMSI/ CCDC requests filed by PI. We are concerned that, taking into account the Tribunal’s acceptance of the arguments put forward by the police bodies and the IC, in particular the Tribunal’s deference to closed evidence, any appeal could lead to a negative decision by the Upper Tribunal. Such a decision would risk further embedding these views and setting a negative precedent not just for this case, but for other FOIs on IMSI Catchers and those seeking to shine a light on other intrusive and potentially rights-infringing uses of technologies.  The aim of PI’s work is to support, not impede, campaigners seeking greater transparency from policing bodies, as well as freedom of information campaigners who are trying to challenge the culture of NCND responses.

Next Steps

This challenge has yielded some wins, such as the IC decisions that make clear that bodies cannot NCND certain categories of information such as marketing and promotional material as well as legislation and codes of practice. Indeed, police bodies’ subsequent responses to this last category, following the IC’s decisions, inconsistently referenced different legislation and codes of practices as governing the use of IMSI catchers. These responses demonstrate the lack of clarity regarding the legal basis for IMSI catcher use, and raise questions about the adequacy of safeguards in place.

The process also exposed that the National Police Chief Council (NPCC) was no longer subject to FOIA.  When the NPCC’s predecessor body became the NPCC, the NPCC was not added as a body subject to FOIA. Thanks to this mistake being exposed by PI’s work and following pressure from PI and Liberty, the NPCC has since been designated a public authority – which in itself is a victory.

This challenge has subjected the forces to much more rigorous scrutiny of their position, thus hopefully encouraging a more diligent and thorough approach in the future when it comes to both FOI requests and purchase and use of surveillance technologies.

After over three years and a lot of work, however, we still do not know the extent of or details regarding the use of IMSI catchers by law enforcement in the UK. Our work does not stop here. PI will continue to advocate for transparency and safeguards to apply to the entire complex and growing ecosystem of surveillance technology, including IMSI catchers.