Police should halt "cyber kiosks" pending legal clarity, MSPs say

Police should halt their deployment of "cyber kiosks", or digital triage devices, until there is greater clarity on the legal framework for their use, according to the Scottish Parliament’s Justice Subcommittee on Policing in a new report.

Cyber-kiosks are laptop-sized machines which allow police to bypass encryption to quickly read personal data from digital devices such as mobile phones or laptops, and Police Scotland have bought 41 of the devices, which they had intended rolling out to police stations across Scotland from the autumn of 2018. However, the police have been unable to use them due to the lack of clarity about the legal basis for using them.

In their report the MSPs, who have been investigating cyber-kiosks since last May, criticise the Scottish Police Authority (SPA) for a lack of effective scrutiny and oversight, and Police Scotland for not following best practice prior to trialing the devices and then deciding to roll out their use across Scotland.

During the trials, the MSPs state, police in Edinburgh and Stirling searched the mobile phones of suspects, witnesses and victims without undertaking the required governance, scrutiny and impact assessments. Members of the public whose phones were seized and searched were not made aware that their phones were to be searched using cyber kiosks as part of a trial, the implications of this, and were not provided with the option of giving their consent.

They also call on the Scottish Government to consider their findings, and to provide clarity on the legal position of cyber kiosks.

Convener John Finnie MSP commented: "The subcommittee fully supports Police Scotland’s ambition to transform to effectively tackle digital crime. However, prior to the introduction of any new technology to be used for policing purposes, an assessment of both the benefits and the risks should have been carried out.

"It appears that, in relation to the introduction of cyber kiosks, only the benefits were presented by Police Scotland to the SPA, with the known risks not provided. The SPA, for its part, seems to have accepted the information provided with very little critical assessment.

"Even the most fundamental questions, such as the legal basis for using this technology, appear to have been totally overlooked."

He pointed out: "This substandard process has resulted in over half a million pounds worth of equipment sitting gathering dust.

"Clearly, this is not an acceptable situation. The subcommittee wants to work with the Scottish Government and the stakeholder groups belatedly assembled to consider the implications of introducing cyber kiosks to find a solution which provides the necessary safeguards for the use of this new technology."

Mr Finnie added that while the events related to the trials were in the past, "the subcommittee remains concerned that this technology was used by frontline officers without any human rights, equality or community impact assessments, data protection or security assessments, and in the absence of any public information campaign". That approach was harmful to the reputation of Scotland’s police service and potentially very serious for any victim, witness or suspect impacted by it, and "Any future trials must be carried out to a far higher standard, with more due diligence and forethought."

Click here to view the report.