UK Information Commissioner Says Police Are Grabbing Too Much Data From Phones Owned By Crime Victims
from the losing-the-tech-race,-eh? dept
The UK's Information Commissioner's Office (ICO) has taken a look at what law enforcement officers are hoovering up from citizens' phones and doesn't like what it sees. The relentless march of technology has enabled nearly everyone to walk around with a voluminous, powerful computer in their pocket -- one filled with the details and detritus of everyday living. And that relentless march has propelled citizens and their pocket computers right into the UK's regulatory void.
The ICO's report [PDF] doesn't just deal with the amount of data and communications UK cops can get from suspects' phones. It also deals with the insane amount of data cops are harvesting from devices owned by victims and witnesses of criminal acts. Left unaddressed, the lack of a solid legal framework surrounding mobile phone extractions (MPEs) will continue to lead law enforcement officers to believe they can harvest everything and look for the relevant stuff at their leisure.
Very few people would consent to this sort of intrusive search, but some aren't aware of how extensive these searches are. Those that are aware are less likely to come forward to help further an investigation, even if they're a victim of a crime.
Large volumes of data are likely to include intimate details of the private lives of not only device owners but also third parties (eg their family and friends). In other words, it is not just the privacy of the device owner that is affected, but all individuals that have communicated digitally with that person or whose contact details have been added by the owner. This presents considerable risks to privacy through excessive processing of data held on or accessed through the phone.
Left unexplained, or in cases where it is not necessary or justified, this intrusion into individuals’ privacy presents a risk of undermining confidence in the criminal justice system. People may feel less inclined to assist the police as witnesses or to come forward as a victim, if they are concerned that their and their friends’ and families’ private lives will be open to police scrutiny without proper safeguards…
Privacy is paramount when dealing with those not suspected of committing criminal acts. Standard MPE practice appears to ignore this crucial element, which only heightens distrust of law enforcement agencies. But privacy concerns are being swept aside in favor of efficiency. Why do things the right way when it's so much easier to do them this way?
PI [Privacy International] published a report calling for an urgent review of the use of MPE by the police, (“Digital stop and search: how the UK police can secretly download everything from your mobile phone” 15). It raised questions over the lawful bases for carrying out extractions, the lack of national and local guidance, and the authorisation process. [...] PI were also concerned that the use of MPE kiosks (‘self-service’ devices used by police forces to download and analyse the contents of individuals’ mobile phones) is becoming more common and forming part of ‘business as usual’ for officers, despite a lack of governance, oversight and accountability in their use.
But if law enforcement officers don't get what they want, there's a good chance crime victims won't get what they want. Here's where things get extremely unpleasant. It's not that crime victims feel this way. It's what's actually happening. When investigators aren't given consent to perform MPEs on crime victims' phones, there's a chance law enforcement will just decide to stop pursuing the investigation.
Here's what Big Brother Watch discovered after obtaining records from multiple police forces in England and Wales:
It found officers had asked for the complainant's mobile phone data in 84 sexual assault cases.
And every one of the 14 of those in which the complainant had declined had then been dropped by police.
The report calls for a long list of improvements and reforms, with an eye on safeguarding the privacy of crime victims and witnesses. ICO says all extractions should be logged and audited routinely. Investigators should be made aware that it's almost impossible to comply with data privacy laws when performing MPEs due to the amount of data/communications present on the average phone -- much of which "belongs" to other people who have communicated with the victim/witness.
It won't be enough to establish guidelines under the current legal framework. ICO says new laws must be put in place to make it explicit what can and can't be obtained with phone searches and when they can be lawfully carried out. This law would also need to set time constraints on examinations of extracted data, as well as the length of time it can be stored once obtained.
For now, the UK's legal framework is more limited than law enforcement's powers. The ICO's report aims to change that. Unfortunately, this will move at the speed of bureaucracy while tech continues to move at the speed of innovation. It's impossible to play catch-up at this speed. I say it's time to hit law enforcement with some broadly-written legislation -- you know, the sort of stuff the normals are forced to deal with all the time. Maybe that will slow the roll of data extraction until the government as a whole has time to address all the nuances.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Reader Comments
Subscribe: RSS
View by: Time | Thread
What do you expect?
I mean, police want a reward for their work like anybody else. Wink wink, nudge nudge, say no more.
[ link to this | view in chronology ]
Re: What do you expect?
Right. Say no more. Everyone understands you. Everyone in this whole Techdirt Marxist community immediately relates to what you are saying. It sounds plausible, it makes sense, because you are all self-admitted morally corrupted godless depraved wicked Marxist criminals. All of you.
Police are not, they are 99.95% Christian God Fearing bearers of truth, liberty and justice, and dedicate their lives to protecting others.
Could it be that if these ladies were so protective of their privacy when they were seeking help from these angels of justice, maybe they were not very serious? Maybe if they didn't value what they needed from the Police enough to be truthful and open, like any good Christian would, maybe it just wasn't that important to them? Could that be it?
You fucking disgusting leftist Marxists are an embarassment to the world. #ShootAMarxist with truth, sunlight and the FEAR OF GOD! That would be good.
[ link to this | view in chronology ]
Re: Re: What do you expect?
Seconded
[ link to this | view in chronology ]
Re: Re: What do you expect?
Well, a God who states that virgins raped within city walls should be stoned together with their rapist because of not raising enough of a ruckus, while somebody raping a virgin outside of the city walls has to marry his victim and is not allowed to divorce her...
That kind of God is really not a suitable reference for how modern police should interact with rape victims.
[ link to this | view in chronology ]
That kind of God is not a suitable reference for anything, really.
[ link to this | view in chronology ]
Re:
Thank you for publicly confirming who and what you are.
[ link to this | view in chronology ]
An agnostic atheist? Why, yes, I am.
[ link to this | view in chronology ]
Re:
A reference for how not to parent or govern.
[ link to this | view in chronology ]
The victim of a crime has the same right to privacy as everyone else. Insistence upon that privacy shouldn’t preclude the truth of a claim by default.
[ link to this | view in chronology ]
Re: Re: What do you expect?
Almost got me with this - Poe's Law in full force here. The key to recognizing this post as humor was the phrase "angels of justice" used to describe the police. Good one, dude!
:D
[ link to this | view in chronology ]
Re: Re: What do you expect?
Yeah, that fear really helped out Manafort from being arrested by leftists, huh?
[ link to this | view in chronology ]
It’s a difficult situation. When it comes to a sexual assault claim, often it is a he said/she said situation. If they are examining the accused’s phone, then they probably should be examining the complainants too. I’m not sure how someone can have a fair trial if the police only look for evidence that is helpful for the complainants account, and do not even look at the complainants phone. The Liam Allan case is one such case where the complainants phone was examined, but the evidence was withheld from the defence. There were messages on that phone which proved that the complainants account was false. He would likely have served a lengthy prison sentence if this evidence never came to light. Disclosure is a very real problem in British justice, it’s the prosecution who decide what to disclose and when. But if they don’t thoroughly investigate by respecting the complainants privacy but violating the defendants privacy – I’m not sure how safe any conviction can really be in such circumstances.
I get a bit tetchy when I hear the word “victim” used when it’s case when there are two different accounts, and the case has not been proven. If one person says they were sexually assaulted and another says it didn’t happen – both parties need to be treated equally and look at the evidence with an open mind. By using the word “victim” instead of complainant, it introduces bias – and implies that the sexual assault did take place. Which likely affects what evidence is sought. Of course if someone is falsely accused the defendant will be the actual victim. That’s why it is safer to keep with the word “complainant” in these types of cases, unless the case has been proven.
Basically I don’t think they should really be differentiating between complainant and defendant. Maybe there needs to be some sort of immunity of prosecution for both the complainant and the defendant for unrelated matters, and agree there should be limits on what the police can search for and retain on the phones.
[ link to this | view in chronology ]
Re:
If the police feel there is a need to search the phone of a "complainant," they are free to go through proper channels to force them to turn over that data, just like they would for the accused. That is what "both parties being treated equally" would look like.
Instead, the police decide that if the "complainant" doesn't turn over all data on their phone voluntarily, they aren't going to continue the investigation at all. That is not an assumption of equality, it is an assumption that not turning over their phone means the complainant is lying, without the corresponding assumption about the accused.
[ link to this | view in chronology ]
Re: Re:
At the moment the proper channels are to ask for consent from a complainant. If consent is not given, that limits the ability in some cases to investigate the case, and likely the defendants right of a fair trial. You need evidence to take forward a case. Phone data may not be relevant, it depends on the case. Of course the phone could have information which helps the complainant prove her case too. Politically the police cannot be seen as getting warrants and demanding that a complainants phone is examined, that would be seen as even worst than the current situation. It is likely to put off people reporting incidents if they will be forced against there will to hand over their phone.
[ link to this | view in chronology ]
Well if they “can’t” get a warrant/subpoena, and they shouldn’t be digging around the phone without the consent of the “complaintant”, what the fuck do you want done?
[ link to this | view in chronology ]
Re:
Shield white men from accusations.
[ link to this | view in chronology ]
Re: Re:
Importantly, that's the relevant data only, not all data ever collected. A person should be able to, for example, provide emails (with headers) matching some query, rather than giving access to the full account. And they'd have the ability to contest any overbroad queries.
[ link to this | view in chronology ]
We wanna see more pictures that have nothing to do with our case
Once the police have access to the phone (both physically and unlocked), how is a law going to stop them from looking at everything on it? Unless the phone is kept by a responsible, non police, third party who will observe and contain the search and collection of evidence within the time and subject matter constraints imposed by law there will be fishing expeditions for either other crimes or mere prurient interest.
And, as pointed out above, those results, in their entirety, should be immediately released to both sides of the conflict. One side or another might have some objections to what was actually looked at and/or collected.
[ link to this | view in chronology ]
Over-Sight
If I have a home video security system, and my house gets broken into, I kind of expect the police investigators to take ALL of the footage. Are the police going to see me entering and exiting my house, deliveries, friends and neighbors? Yup.
I suppose the biggest concern for me is public disclosure. Just as your doctor will know about your medical situation in order to provide care, the police are going to investigate your life in order to secure a conviction against a perp. And the police have limited time and resources, so I expect them to prioritize cases with the best chances, not the worst chances.
So perhaps we need something similar to HIPAA laws, where it is understood that access to information is needed for an investigation, but confidentiality is also expected.
[ link to this | view in chronology ]
Re: Over-Sight
But if there was a break-in we don't expect the police to box up everything in the whole place and take it to a warehouse to be investigated at their leisure on the off chance they find someone's fingerprint on the inside of your photo album (that special Private photo collection you had)
comparisons don't work well because the amount of data/access that can be found in and through some people's phones is far more intrusive than any search we'd agree to.
[ link to this | view in chronology ]
The sensible thing to do is use a burner phone to minimize the rights violations you will likely be unable to challenge in court. They can't get a lot of personal information from a phone you reserve with the expectation your rights will be trampled on. It's not difficult to buy a cheap phone and register it without supplying any personal information attached to it by doing so from a location other than where you live. Just leave the battery out when you are anywhere close to home.
[ link to this | view in chronology ]
Re:
Be careful you don't leave an obvious "dead area" on the tracking map. In the TV series "The Lost Room", they plotted where some objects had gone, and found a suspicious circle where none had ever been. Guess where the guy they were looking for lived?
[ link to this | view in chronology ]
phones can contain a lot more information than a few home security videos could ever include...
Personal notes, date references, pictures (unrelated to the issue at hand), video, location data, etc...
[ link to this | view in chronology ]