Policing Bill: An unsatisfactory debut on the statute books for mobile phone extraction

Why is voluntary provision aka consent problematic?

Consent or voluntary agreement sound empowering. It gives the appearance of control by an individual of their device and their data. But it does not appreciate the power imbalance between the state and an individual.

Whilst there may be a case for a process by which a victim can voluntarily provide a device to police containing a specified text message or photos, to introduce voluntary agreement as the only solution to the absence of clear legal basis to use extraction technology is a missed opportunity.

In June 2020 the Information Commissioner's Office (ICO) released its critical report on the use of extraction technology. The ICO called for reforms and safeguards to protect an individual's data from unnecessarily intrusive practices. The ICO echoed PI's concerns that currently, there is no clear legal basis, policy guidance or independent, effective oversight for police forces' use of extraction technology.

Not only is there a failure to provide clear powers of seizure and extraction that do not rely on voluntary provision and agreement - the use of voluntary provision and agreement are problematic.

As pointed out by the Victim's Commissioner Vera Baird QC in evidence to the Bill Committee, there is no definition of 'agreement' in the Bill and

"we know very well ... that often, there is a sort of implicit threat that if you do not [hand over the device] that is the end of the story."

She further raised:

"the big concern that the Bill describes information to extract as relevant but does not make reference to the very important turn of phrase in the legislation, which is a "reasonable line of inquiry". It is much broader."

Given the inherent power imbalance between the police and the user, the instances in which provision of a device will be truly voluntary is questionable. The ICO state in their report that individuals may be worried that a decision not to consent will impact on the progress of their case, especially when the electronic devices are taken from victims of rape and sexual assault. In addition, the owner of the device cannot provide agreement on behalf of all others whose data is stored on their device, such as family and friends.

The Bill is notably silent on the ability of the individual to withdraw their agreement to the provision of their device i.e., request its return and whether an individual can cease their agreement to the gathering and storage of their data.

Further the lack of information provided to the individual regarding the extraction, examination, retention, deletion, sharing and search parameters undermines the idea that providing the device can be properly informed. An individual will not be aware whether data will be extracted from the Cloud, what search parameters exist if any or whether advanced machine learning technology will be used.

PI's preference is, as in the US, for a warrant system which ensures independent oversight into what data is examined and provides a layer of protection to ensure that it is only that which is strictly necessary. We elaborate on this separately and look at the Law Commission's extensive report and recommendations for search warrants.

The devil is in the detail

Much focus is on the implications of Chapter 3 'Power to extract information from electronic devices' for mobile phone extraction. Yet this provision applies to all electronic devices.

The Bill provides that "electronic device" means any device on which information is capable of being stored electronically and any component of such a device.

This is problematic. Despite PI's ground-breaking report in April 2018 which exposed lack of legal basis, absence of either safeguards or independent oversight in relation to mobile phone extraction, there is a paucity of information on extracting data from devices such as Amazon Echo, Google Home, Fitbit, connected toys, smart TV and the plethora of so called internet of things.

We will explore in more detail in a separate update, our concerns around connected devices and the FOIA we sent in 2017 to UK police extracting data from IOT. Suffice to say this area is hugely opaque and that's not a good thing.

Immigration Officers

The power imbalance which makes a mockery of voluntary agreement is likely to be particularly acute when it comes to migrants, who may be in vulnerable circumstances and face language barriers.

“A few months ago, I went to a large asylum hospital in my constituency, where there were 50 to 100 men—I do not know how many—and what concerned them most was that, literally as they entered the country, their mobile devices and indeed clothes were taken off them. There was no debate or explanation; it is just part of the process.”

Sarah Champion MP

Not only are migrants in vulnerable circumstances, seizing their phones completely cuts them off from communications with their family members in their countries of origin.

In addition, if the data is being extracted for the purposes of decision making, the skills of immigration officers are in question. The delivery of justice is dependent on the integrity and accuracy of evidence and trust that society has in it. As Sarah Champion MP raised at Committee stage:

“Extracting data is a complex process that requires specialist experience, and it ought to be managed under the law. I am concerned that we are asking immigration officers to be incredibly mindful, and to be trained and resourced, and to have all the skills, to request that device”

Warrant

You could search a person, and their entire home and never find as much information as you can from searching their phone. Yet the police can take data from your phone without a search warrant. The only proposal in the PCSC is 'voluntary provision' and 'agreement'.

As noted in the landmark US ruling of Riley v California

an element of pervasiveness characterises mobile phones with data that can go back years and shed light on nearly every aspect of a person’s life. The US Supreme Court ruled that whilst data on a mobile phone is not immune from search, a warrant is generally required before such a search, even in connection with an arrest. The warrant requirement was held to be “an important working part of our machinery of government”, not merely “an inconvenience to be somehow ‘weighed’ against the claims of police efficiency”.

Both the Law Commission and ICO have warned about excessive data extraction and processing from mobile phones. Despite the availability of privacy-enhacing functions in the software tools, police forces simply grabbed more data than necessary in the investigative process. In a concerning observation, the ICO report warned that the police cannot seize phones to go on fishing expeditions.

The Bill does not address these concerns. Nor does it provide detail of independent oversight, notification and redress mechanisms.

Effective search warrants which take account of the Law Commission's report into Search Warrants are a fundamental way to ensure against abuse or misuse of extraction powers.

Conclusion

As the Bill moves to the House of Lords, we encourage close examination and scrutiny of the provisions for electronic devices. The Bill should not proceed in its current form. We remain hopeful that clear, precise and comprehensive provisions for extraction of data from electronic devices will be established which take into account recommendations of the ICO and Law Commission.