Police compliance with covert investigatory powers ‘generally high’, says Investigatory Powers Commissioner

In his report on the use and oversight of covert investigatory powers, the Investigatory Powers Commissioner said he had seen “extremely positive engagement from public authorities throughout 2021, in relation to both our authorisations and inspection work”.

“Authorisations of the use of investigatory powers, either through the Office for Communications Data Authorisations (OCDA) or the Judicial Commissioners, continue to provide a fundamental safeguard, ensuring compliance with the relevant legislation and giving reassurance that activities are lawful,” said Sir Brian.

“Since the Investigatory Powers Commissioner’s Office (IPCO) began reporting, 2021 was the first year with no serious errors.

“This is a significant achievement, meaning that for the first time none of the cases investigated caused significant prejudice or harm to a particular individual.

“It is pleasing to see that our concerns are taken seriously and addressed, and that compliance procedures are now more routinely embedded into standard operational activity.

“There have, however, been some disappointing findings in a minority of public authorities. Urgent action is needed to address the concerns identified around non-compliance, inconsistency and vulnerability.

“I am confident that the organisations in question will implement sufficient remedial work in response to the issues identified.”

Areas of concern highlighted in the report this year relate to undercover operatives in Police Scotland, handling of material by law enforcement, the out of hours warrant process at the Home Office, the authorisation of surveillance techniques at MI5 and the interception of communications in prisons.

Sir Brian said in early 2021, following a change in management structures and an internal review, it was alerted by Police Scotland to the discovery of “several significant failings in relation to the use of undercover operatives”.

The majority of issues identified by the force concerned poor supervision resulting in, in some cases, non-adherence to internal standard operating procedures (SOPs). These matters were raised with us as potential compliance failings in some areas which, if not addressed immediately, would likely lead to future compliance issues.

“We worked with Police Scotland to offer guidance and develop both immediate and longer-term solutions. In our inspection in May 2021, we paid particular attention to the issues that had been brought to our attention,” said Sir Brian.

Several areas requiring action were identified, including:

• The management of risk during operational deployments was questionable, leaving practitioners concerned for their personal safety;
• The oversight required by the Covert Operations Manager (COM-UC) was lacking, with no regular contact with operational staff;
• Operational security measures, necessary for the development of these specific covert tactics, had been undermined, with several standard operating procedures not followed;
• Limited engagement with the Covert Authorities Bureau (CAB), responsible for the compliant construction of necessary authorisations. This has led to a lack of understanding and limited assessment of legislative requirements; and
• A failure properly to develop, deploy, store and audit necessary technical equipment, and a failure properly to retain, review and destroy (RRD) covertly obtained material, leading to non-adherence to the safeguarding responsibilities outlined within the relevant Code of Practice.

Following the inspection, the Investigatory Powers Commissioner directed that an interim inspection of the Special Operations Unit (SOU) should take place to assess progress.

In August 2021, a further inspection was undertaken with members of the force’s senior management team.

“Between the annual and interim inspections, we held regular meetings with the head of the SOU to monitor compliance improvements and to mentor the officer who, while experienced, was relatively new to the role. This helped to assure that those procedures being developed would meet good practice standards and assist in future proofing the use of these covert tactics,” the Investigatory Powers Commissioner said.

“The chief constable and deputy chief constable (as senior responsible officer) were strong advocates for developing the required improvements and were commended in this regard. We have continued to hold follow up conversations with the head of SOU, with this covert tactic identified as an area for further, specific focus during the 2022 inspection.

“Police Scotland has taken immediate action in response to our recommendations

“This is an excellent example of how we can work with public authorities to encourage the development of good practice and promote improvements in compliance standards, particularly when deploying the highest level of intrusive covert tactics available.”

The IPCO inspection in June 2021 found that Police Scotland continues its “good track record of compliance with the requirements of the Act and Code of Practice”. Where warrants were modified, the necessity and proportionality of the conduct authorised was fully justified.

“Warrants were being kept under constant review,” said the Investigatory Powers Commissioner. “We saw some particularly thorough reviews, renewals and cancellations which detailed the value of the interception to date and, where relevant, the continuing need to undertake interception. Police Scotland demonstrated a clear understanding of the geographical limits of interception warrants granted by a Scottish minister and the Home Secretary.

“The safeguarding of intercept product was being diligently managed by Police Scotland, although we recommended the handling arrangements document should be reviewed annually to ensure it remained current.”

In 2021, most authorisations for the use of investigatory powers were for the purpose of preventing or detecting crime.

For communications data authorisations, the most common crime type under the “prevent and detect” statutory purpose related to drugs offences.

There were 450 inspections conducted in 2021.

The IPCO identified examples of best practice in many public authorities, including the continued focus on compliance within MI5 and the implementation of its ‘three lines of defence’ model; the increasing use of technology by GCHQ to enhance compliance with Investigatory Powers Act standards; and a novel collaborative approach led by Hampshire County Council, in conjunction with the National Trading Standards and the Federation Against Copyright Theft, to use its powers in relation to unlawful TV streaming.

In 2021, the Covert Human Intelligence Sources (Criminal Conduct) Act 2021 came into force. This included a new requirement to notify the Investigatory Powers Commissioner of authorisations for criminal conduct by those who are working undercover, and the report indicates some learning is still required in this.

There continues to be an increase in the authorisations of online operatives. This is targeting a wider range of criminal activity and threats to national security as law enforcement recognises that virtually all forms of organised criminality and extremism will utilise the internet and social media to some extent.

As with the IPCO’s previous findings, drug-related offences were again the most common crime type under the “prevent and detect” statutory purpose, for which communications data was requested by law enforcement agencies in 2021.

The Commissioner said he makes it “a priority” to share information that can be made public, in an effort to enhance transparency and increase understanding of the use of investigatory powers.

The report shows that, in general, recommendations from IPCO’s inspections have been implemented by public authorities, Sir Brian said.