We can confirm that the police can no longer deny our freedom of information requests

Create Commons Photo Credit: Source

Privacy International has achieved an important victory for government transparency and information access rights. This victory stems from a long-running battle with the government to obtain information about the UK police’s purchase and use of IMSI catchers. The Information Commissioner’s Office (ICO) recently issued a series of decisions, which agree with Privacy International that police forces cannot rely on a position of “neither confirm nor deny” (NCND) to refuse Freedom of Information Act 2000 (FOIA) requests for the following categories of records: legislation, codes of practice, and marketing or other promotional materials related to IMSI catchers.

At the same time, the ICO dismissed Privacy International’s arguments that the police forces cannot rely on NCND to refuse FOI requests for several other categories of records, including internal policy guidance as well as contracts and other records regarding the purchase of IMSI catchers. Privacy International, represented by Liberty, is appealing this part of the ICO’s decisions to the First-tier Tribunal.

IMSI Catchers

IMSI catchers are a type of mobile phone surveillance technology, which mimic mobile phone base stations. By simulating base stations, IMSI catchers trick all mobile phones within a particular radius to connect to them. Once connected to an IMSI catcher, mobile phones reveal data that uniquely identifies them and therefore the mobile phone user. This identification process also allows IMSI catchers to determine the location of mobile phones (and their users). Some IMSI catchers can intercept or even manipulate communications or data, by editing or rerouting them. And some IMSI catchers can also block service to mobile phones within their range.

Where IMSI catchers intercept communications and data (such as calls, text messages, and internet data) transmitted from mobile phones, they pose the same privacy concerns as other methods of communications surveillance. But the interception of data that identifies mobile phones introduces a separate layer of privacy concerns. Mobile phones are uniquely and intimately tied to specific individuals. By combining this data with other information, the government can not only determine the identity of those individuals, but also track and profile them, including where they go, what they do and with whom they meet.

IMSI catchers are inherently indiscriminate surveillance tools, deceiving all mobile phones within their radius to identify themselves and reveal the personal data and location of their users. For that reason, IMSI catchers not only interfere with the rights to privacy and freedom of expression, but also pose a particular threat to the right to freedom of assembly and association. The government may, for example, use IMSI catchers at public gatherings, such as at a protest, to identify and collect the personal data of all those in attendance.

UK Police use of IMSI Catchers

One of the earliest reports of UK police use of IMSI catchers dates back to 2011, when The Guardian published an article indicating that the Metropolitan Police Service (Met) had acquired an IMSI catcher from the Leeds-based company Datong plc. Over the next few years, other media reports suggested the use of IMSI catchers throughout London.

In October 2016, The Bristol Cable published an article citing to evidence revealing that, in addition to the Met, six other police forces have purchased IMSI catchers (Avon & Somerset, South Yorkshire, Staffordshire, Warwickshire, West Mercia and West Midlands). Purchase records indicated that the Met had spent over £1 million on IMSI catchers in 2015. They further revealed that in a similar period, Avon and Somerset Police spent nearly £170,000 and South Yorkshire Police spent £144,000 on IMSI catchers.

In subsequent reporting by The Guardian, a number of policing officials attempted to reassure the public that their use of IMSI catchers was subject to proper safeguards and oversight. For example, the West Mercia Police and Crime Commissioner stated: “I am reassured on behalf of our local communities that the safeguards and processes in place will ensure this technology will be used appropriately and proportionately.” Similarly, the Staffordshire Police and Crime Commissioner stated: “[I]t is crucial that there are robust safeguards, framed by legislation, around this work, and there are.”

Privacy International Freedom of Information Requests

In November 2016, Privacy International submitted FOI requests to the police forces identified in the reporting by The Bristol Cable. The requests sought:

• Purchase orders, invoices, contracts, loan agreements, solicitation letters, correspondence with companies and other similar records regarding the acquisition of IMSI catchers;
• Marketing or promotional materials received by the police forces relating to IMSI catchers;
• All requests made to the police forces by companies or government agencies to keep confidential any aspect of the police forces’ possession and use of IMSI catchers, including any non-disclosure agreements;
• Legislation, codes of practice, policy statements, guides, manuals, memoranda, presentations, training materials or other records governing the use of IMSI catchers by the police forces, including restrictions on when, where, how and against whom they may be used; limitations on retention and use of collected data; guidance on when a warrant or other legal process must be obtained; and rules governing when the existence and use of IMSI catchers may be revealed to the public, criminal defendants, or judges.

All of the bodies we wrote to refused every category of the request on grounds that they could “neither confirm nor deny” (NCND) whether they held the information. Privacy International challenged the bodies’ reliance on NCND to refuse our requests by requesting an internal review. Upon internal review, each of the bodies upheld their initial decisions. Privacy International then challenged those decisions by appealing to the ICO. For a detailed analysis of the police forces’ position and our arguments in response, please see our case study here.

The Information Commissioner’s Office (ICO) Decisions

In July 2018, the ICO issued its decisions. It agreed with Privacy International that for several categories of information the police forces could no longer rely on NCND:

• Marketing or promotional materials received by the police forces relating to IMSI catchers;
• Legislation;
• Codes of practice.

For these categories of information, the police forces are now required to confirm or deny whether they hold records, and to either disclose this material or issue a refusal under a relevant FOIA exemption.

The ICO did, however, uphold the police forces’ NCND position for the remaining categories of records requested by Privacy International:

• Purchase orders, invoices, contracts, loan agreements, solicitation letters, correspondence with companies and other similar records regarding the acquisition of IMSI catchers;
• All requests made to the police forces by companies or government agencies to keep confidential any aspect of the police forces’ possession and use of IMSI catchers, including any non-disclosure agreements;
• Policy statements, guides, manuals, memoranda, presentations, training materials or other records governing the use of IMSI catchers by the police forces.

Privacy International, represented by Liberty, will appeal this part of the ICO’s decisions.

Conclusion

For nearly two years, Privacy International has fought to increase transparency around law enforcement acquisition and regulation of IMSI catchers, which has long been shrouded in secrecy. This fight reveals the police forces’ troubling reliance on NCND, thereby stifling a much-needed public debate about IMSI catchers specifically and UK police forces’ use of surveillance technology more broadly. We are heartened that the ICO has agreed that the use of NCND is inappropriate for several categories of information, and we plan to publish any materials that we hope police forces will finally disclose to us as a result of the ICO’s decisions. We are also challenging those parts of the ICO’s decisions that continue to uphold the use of NCND for other categories of information, including internal policy guidance and records related to the purchase of IMSI catchers, which we believe remain essential to properly understand and scrutinise law enforcement use of this intrusive surveillance technology.