Association of Chief Police Officers of

England, Wales and Northern Ireland

ACPO Data Communications Group1
C/o CEOP Centre
33 Vauxhall Bridge Road
London SW1V 2WG.
Tel: (020) 7238 2387
Website: www.acpo.police.uk

Chair: Deputy Chief Constable Jim Gamble, QPM

Mr Nigel Burrowes
Home Office
Communications Data Consultation
Room P5.37
2 Marsham Street
London SW1P 4DF

Copy to-
CC Tim Hollis - ACPO Presidency, CC Keith Bristow – ACPO Crime Business Area, CC Martin
Baker – ACPO OCPB, DCC Jon Murphy – ACPO Organised Crime Portfolio, ACC Suzette
Davenport – ACPO Covert Investigation (Legislation and Guidance) Peer Review Group
th
27 July 2009

Dear Nigel

Protecting the Public in a Changing Communications Environment – A

Public Consultation – Government Proposals to Ensure
Communications Data Remains Available for Future Electronic
Communication Services
Apologies for the delay in our submission, my travel arrangements over the past 10 days to the
United States limited my viewing of restricted documents.

I write to you in my capacity as the Chair of the ACPO Data Communications Group (“the DCG”),
which comprises senior representatives from ACPO, ACPO (Scotland), Her Majesty’s Revenue &
Customs, Serious Organised Crime Agency, the Child Exploitation Online Protection Centre, other
public authorities and senior members of the communications industry and their trade associations.

The purpose of the DCG is to foster and support co-operation between the communications
industry and both law enforcement agencies and other public authorities in support of public
protection and to ensure uniformity of policy in their interaction with communications service
providers (CSP) operating in the United Kingdom.

1
ACPO Data Communications Group comprises of representatives from ACPO, ACPO (Scotland), Her Majesty’s
Revenue & Customs, Serious Organised Crime Agency, the Child Exploitation Online Protection Centre, other public
authorities and senior members of the communications industry and their trade associations. The purpose of the DCG
is to foster and support co-operation between the communications industry and both law enforcement agencies and
other public authorities in support of public protection and to ensure uniformity of policy in their interaction with
communications service providers (CSP) operating in the United Kingdom.
The Association of Chief Police Officers (ACPO) is an independent, professionally led strategic body. In the public
interest and, in equal and active partnership with Government and the Association of Police Authorities, ACPO leads
and coordinates the direction and development of the police service in England, Wales and Northern Ireland. In times
of national need ACPO, on behalf of all chief officers, coordinates the strategic policing response.
ACPO is registered as a private company limited by guarantee in England & Wales – registered address: 10 Victoria Street, SW1H 0NN. Company Number
3344583.
I readily acknowledge that communication data records are highly intrusive as they may give an
insight into the everyday activities of the user of a communications device. As a consequence, and
it is one that needs to be better understood by politicians, policy makers, privacy lobbyists and the
public, communications data records are of very significant value to law enforcement in assisting
victim based investigations (for example murder, sexual offenders grooming children in the online
environment) and targeted operations (for example drugs, people trafficking, sexual
offenders seeking to rent children for sex).

Background

Since 2004, work has been undertaken as a joint venture between ACPO DCG and Home Office to
strategically take forward the need to:

• Engage with communications service providers to identify those providers less able to
assist law enforcement effectively and efficiently or are looking to reduce their retention of
communications data to:
– undertake analysis with identified providers to assess the impact of retaining data;
– undertake assessment of data retrieval issues and
– undertake assessment of data acquisition issues.

• To assist Home Office to transpose the EU Data Retention Directive 2006/24/EC

mandating communications service providers to retain communications data they generate
or process for minimum of 12 months and ensure the disclosure mechanisms are for fit for
our operational purposes.

Research by ACPO DCG thus far has concluded that communication service providers based in
the European Union will continue to generate or process communications data relating to the
provision of their communication services but are seeking to develop and implement new services
in the online environment (accessed through GSM and broadband (which includes Wifi)) and
collect revenue by several means, for example:

• charging the customer in advance (e-pay, pre-pay);

• customer subscription (monthly subscription etc);
• advertising revenues by attracting users to particular services and inter-active experiences
within the online environment and
• collecting, generating or processing personal information about their customer’s online
habits, service selections, inter-actions, geographical movements and browsing trends, and
then utilising that information for the development of new services, sharing that information
with other parties to enable targeted advertising to be aimed at their customers.

The take up of broadband in the UK is at the comparatively higher end of take up within the EU,
which means the UK is experiencing policing and policy issues that are not necessarily mirrored
elsewhere, especially with our young citizen’s strong desire for latest laptops with WiFi internet
access and mobile devices on 3G with internet access.

Even though the EU DRD goes a long way to assisting law enforcement to determine the ‘who’,
‘what’, ‘where’ and ‘when’ of a communication, we have previously highlighted to Government
problems in seeking access to communications data and other data which relate to applications
available in the broadband internet environment which are very significant, for example:

• other data relating to services that are classed as “information society services”. Their
specific function/s are said to be outside the scope of the EU DRD and not included within
definition of communications data relating to the acquisition and disclosure provisions of
Chapter 2 of Part 1 RIPA, for example:

• social networking services such as My Space, Bebo, Facebook etc. The

phenomenal explosion in social networking services has left most Governments in
The Association of Chief Police Officers (ACPO) is an independent, professionally led strategic body. In the public
interest and, in equal and active partnership with Government and the Association of Police Authorities, ACPO leads
and coordinates the direction and development of the police service in England, Wales and Northern Ireland. In times
of national need ACPO, on behalf of all chief officers, coordinates the strategic policing response.
ACPO is registered as a private company limited by guarantee in England & Wales – registered address: 10 Victoria Street, SW1H 0NN. Company Number
3344583.
 the starting blocks when considering privacy, security and the ability of law
enforcement to respond to situations where our citizens are at risk, for example
suicide intervention.

• services that make anonymous the origin of a communication or web posting;

• the ever increasing number of communication services that may be accessed through
broadband connectivity where the office of the service provider, the systems providing the
service and, if generated or processed, the data relating to it are held offshore and
therefore outside United Kingdom jurisdiction (“3rd party services”);

• if communications data is generated or processed the 3rd party service may be hosted
within countries where there are security and or legal difficulties in undertaking the
acquisition of the communications data or other data;

• Data mentioned in ATCSA voluntary code of practice but absent from the EU DRD
mandate and yet within scope of Chapter 2 of Part 1 RIPA – acquisition of communications
data – an issue that needs to be reconciled-

• Web-activity logs – includes date/time, IP address used;

• URLs visited to the extent that content is not revealed.

The consultation set the following questions as part of the consultation-

Question 1 On the basis of this evidence and subject to current safeguards and oversight
arrangements, do you agree that communications data is vital for law enforcement, security
and intelligence agencies and emergency services in tackling serious crime, preventing
terrorism and protecting the public?

Question 2 Is it right for Government to maintain this capability by responding to the new
communications environment?

Question 3 Do you support the Government’s approach to maintaining our capabilities?

Which of the solutions should it adopt?

Question 4 Do you believe that the safeguards outlined are sufficient for communications
data in the future?

At the start of the public consultation, ACPO DCG received feed-back from police colleagues
stating the consultation questions did not necessarily assist the law enforcement community share
their operational experiences, difficulties and concerns in accessing communications data and
other data, especially those generated in the online environment.

The public consultation makes explicit on page 31 that it is permissible to submit additional
comments that are not catered for in the consultation. To assist law enforcement to express those
requirements and concerns in a consistent manner, additional questions were posed by ACPO
DCG as follows:

Additional Question 1 - Previous public consultations [see below] have set out how vital
communications data is to law enforcement, security and intelligence agencies and
emergency services in tackling crime, maintaining our national security and safeguarding
the public. The Government has recently mandated communication service providers within
the UK to retain data they process or generate until they are required to disclose it-

The Association of Chief Police Officers (ACPO) is an independent, professionally led strategic body. In the public
interest and, in equal and active partnership with Government and the Association of Police Authorities, ACPO leads
and coordinates the direction and development of the police service in England, Wales and Northern Ireland. In times
of national need ACPO, on behalf of all chief officers, coordinates the strategic policing response.
ACPO is registered as a private company limited by guarantee in England & Wales – registered address: 10 Victoria Street, SW1H 0NN. Company Number
3344583.
 • Where such communications services do not generate data within the United
Kingdom, do you agree with the Government’s proposal to intervene and
develop a capability enabling law enforcement and the intelligence agencies to
respond to the new communications environment?

• If not, why not and can you suggest another way forward?

• Would restricting access from internet users within the United Kingdom to
communications services situated outside the United Kingdom be justified as a
reasonable alternative?

Additional Question 2 - If the Government chose not intervene – do members of law

enforcement perceive there is a current or future threat from such communications services
being openly available for use by criminals (for example sexual offenders grooming children
in the online environment, persons planning or encouraging others to commit terrorist
atrocities, those involved in people and drugs trafficking etc) who may be able to exploit
these facilities in an attempt to circumvent detection?

Additional Question 3 - Do you have examples from recent investigations or operations

where you sought access to communications data where-

• Data was generated or processed (e.g. web-chat, VOIP to VOIP

communications) but it was not retained or retrievable;

• Services accessed by people in the UK but system providing service hosted

outside of the UK had a significant delay or obstruction in acquiring data due to
prolonged or obstructive legal process e.g. social networking websites, e-mail
service provider;

• Services accessed by people in the UK but system providing service hosted

outside of the UK but there was a significant security risk in making an approach
within the hosting state – and so none made;

Additional Question 4 – Do you consider the current legislation (Part I RIPA which relates to
the (i) interception of communications and (ii) the acquisition and disclosure of
communications data) meets for your operational need, for example-

• Having to differentiate between notices and authorisations (despite the

processes set out in the Chapter II Code of Practice which partly reduces
unnecessary bureaucracy for subscriber information);

• End user device (e.g. lap-top) seized for evidence but the communications
service provider and the communications system (containing the electronic mail
sought) are outside of the UK;

Response to the consultation questions

Question 1 On the basis of this evidence and subject to current safeguards and
oversight arrangements, do you agree that communications data is vital for law
enforcement, security and intelligence agencies and emergency services in tackling
serious crime, preventing terrorism and protecting the public?

Current safeguards and oversight arrangements-

Full inspections concerning the use of powers relating to the acquisition and disclosure provisions
of Chapter 2 of Part 1 RIPA by the Interception of Communications Commissioner’s Office
(IOCCO) started in October 2005 and are undertaken 12 to 18 months apart dependent on the size
The Association of Chief Police Officers (ACPO) is an independent, professionally led strategic body. In the public
interest and, in equal and active partnership with Government and the Association of Police Authorities, ACPO leads
and coordinates the direction and development of the police service in England, Wales and Northern Ireland. In times
of national need ACPO, on behalf of all chief officers, coordinates the strategic policing response.
ACPO is registered as a private company limited by guarantee in England & Wales – registered address: 10 Victoria Street, SW1H 0NN. Company Number
3344583.
of the law enforcement agency or subsequent action plans that may have been given on the
previous inspection, which may also have necessitated an interim inspection.

Every law enforcement agency, at the end of 2008, had received at least two full inspections from
the Commissioner’s inspectors. A full inspection (2 inspectors) takes at least 3 full days in a small
police force, which does not include the time spent preparing the inspection report.

The inspections make recommendations on efficiency, developing better systems for handling
applications, training issues, the reporting of errors to the Commissioner’s office and reducing
unnecessary bureaucracy. ACPO DCG is not aware of any instances when the Commissioner has
deemed it necessary to refer matters to a RIPA Investigatory Powers Tribunal concerning the
acquisition of communications data by a law enforcement agency.

As regards the Interception Commissioner and his inspection of law enforcement agencies
concerning the acquisition of communications data, members of my ACPO DCG portfolio work in
liaison with the Commissioner to ensure good practice highlighted during inspection are
promulgated and help identify training requirements within the law enforcement agencies.

The inspection reports prepared by IOCCO concerning law enforcement agencies are made
available to Her Majesty’s Inspectorate of Constabulary.

Within every relevant public authority a senior responsible officer2 (within the police, the role is
undertaken by a minimum of superintendent) must be responsible for:

• the integrity of the process in place within the public authority to acquire
communications data;

• compliance with Chapter 2 of Part 1 of the Act and with the code of practice;

• oversight of the reporting of errors to IOCCO and the identification of both the cause(s)
of errors and the implementation of processes to minimise repetition of errors;

• engagement with the IOCCO inspectors when they conduct their inspections, and

• where necessary, oversee the implementation of post-inspection action plans approved

by the Commissioner.

Communications data is vital in assisting law enforcement investigations and operations-

Communications data, which does not include the contents of communications, has proved
valuable for law enforcement purposes over many years. Lawful access to communications data
allows investigators to identify suspects and their ‘hidden’ means of communication, trace their
criminal contacts, establish hierarchical relationships between conspirators, place them in specific
locations at specific times, identify their banks and those engaged in laundering their criminal
finances and assets both in the UK and abroad, and can confirm or disprove suspects’ alibis.

In murder cases especially the analysis of communications data gives an insight to who the victims
were in contact with, their movements and the last person the murder victim had contact with,
using communications equipment, prior to their death. In other cases, communications data can
corroborate the testimony of victims, in particular those subject to sexual assault where the
offender claims prior contact with the victim.

It is regularly used by the police to assist Her Majesty’s Coroner in establishing the activity of a
deceased person prior to their death where no crime has occurred.

2
The senior responsible officer should be a person holding the office, rank or position of a designated person within the public authority
who may authorise communications falling within section 21(4)(a) and or 21(4)(b).
The Association of Chief Police Officers (ACPO) is an independent, professionally led strategic body. In the public
interest and, in equal and active partnership with Government and the Association of Police Authorities, ACPO leads
and coordinates the direction and development of the police service in England, Wales and Northern Ireland. In times
of national need ACPO, on behalf of all chief officers, coordinates the strategic policing response.
ACPO is registered as a private company limited by guarantee in England & Wales – registered address: 10 Victoria Street, SW1H 0NN. Company Number
3344583.
The Child Exploitation and Online Protection Centre, set up by the Government just over three
years ago, is completely reliant on internet-related data to be able to carry out its function of
protecting our young citizens by identifying sexual offenders in the online environment.

Communications data can assist to remind the witness, corroborate the victim, challenge the
suspect’s account or corroborate their alibi. Researching the account given by the victims of sexual
crime is especially vital as the corroboration of their potential testimony is a requirement in law so
as to minimise spurious prosecutions. It can assist in showing the contacts made and the routine of
the victim prior to the rape and give that essential corroboration. It may also be used to counter a
rape allegation, for example to indicate social contact between the victim and the suspect where
such contact has been denied, which will cast doubt on the legitimacy of the allegation.

Communications data focuses the investigation and may give an indication of persons, places and
times of interest which assist in the development of tactical responses or evidence gathering
opportunities such as access by the investigator to CCTV, DNA, fingerprints, banks and other
means of communication. Examples include:

• identifying persons whose means of communication is found to be contacted by several

suspects;

• ability to show hierarchical structure of the suspects;

• identify mechanism for past travel arrangements and possible future intentions to travel;

• confirming association to or identifying an address or “safe house”;

• indicating a particular route travelled and the method of transport;

• confirming the regular use of specific accommodation by early morning and late evening
cell site activity;

• indication of the use of alternative means of communication to guise illicit dealings such a
SIM card swapping;

• identify financial interests and banking arrangements.

Communications data and its acquisition in supporting major crime investigations is now ingrained
into the investigative culture and can be said to be part of the incident room’s DNA. Police forces
have invested in the training and development of specialist communications data investigators and
analytical teams to ensure the maximum use is made of communications data.

In trials for serious and organised crime, in particular the importation of controlled drugs and
people trafficking, a highly significant proportion of the evidence is based around
communications data. That evidence will consist of information gathered from:
• surveillance;
• seizures and the arrest of couriers;
• forensics and
• communications data.

Communications data and the analysis of that data surrounding the significant events (“sequence
of events”) identified during the course of an investigation or operation can and does play a vital
part in establishing the prosecution case, often in respect of the suspects who tend to be the
“bigger players” but who are rarely to be found “hands on.”

The sequence of events, which will be based predominantly on communications data, will often be
the most compelling evidential link between the defendants. The absence of the communications
The Association of Chief Police Officers (ACPO) is an independent, professionally led strategic body. In the public
interest and, in equal and active partnership with Government and the Association of Police Authorities, ACPO leads
and coordinates the direction and development of the police service in England, Wales and Northern Ireland. In times
of national need ACPO, on behalf of all chief officers, coordinates the strategic policing response.
ACPO is registered as a private company limited by guarantee in England & Wales – registered address: 10 Victoria Street, SW1H 0NN. Company Number
3344583.
data would make the task of prosecuting many offenders impossible.

Whilst there would still be evidence against a number of the defendants without the
communications data, it is almost certain that a significant proportion of suspects would not be
prosecuted, because it would not be possible to state that there was a realistic prospect of a
conviction without the evidence derived from communications data. It is often the provision of the
evidence derived from communications data that convinces defendants to plead guilty, particularly
in conspiracy cases.

Question 2 Is it right for Government to maintain this capability by responding to the

new communications environment?

The law enforcement community must not be put in a position of not having the capability or
capacity to police, or undertake the acquisition of communications data relating to, criminal
activities within or communicating via the online environment.

The police requirements are derived from our standing duty to “cause the peace to be kept and
preserved and prevent all offences against people and property”.

Communciations data is used to save life, for example - suicide intervention, determining from
where ransom or extortion demands originate, where hostages are held, locating and rescuing a
child when we learn they may be meeting up with a sexual offender they first met in the online
environment.

If the Government does not maintain the capabilty or capacity for the police to determine, when
necessary and proprtionate and in accordance with law, as to who has communcted with whom
and when, the police service will face a fundimental breakdown in our abilty to function in, what is
now termed, the communciations age.

We are already witnessing fundamental changes to the ways in which our citizens communicate
with each other. Those changes have even taken those who operate in the commercial
environment by surprise –

Social networking driving mobile data boom

Around a third of young adults (those under 36) in the UK regularly access sites such as
Facebook and Twitter from their mobile phones, suggesting that operators should keep
working with trusted web brands to fuel internet usage.
We believe that mobile will soon become the most popular way of accessing social
networking sites, giving real time access to tweets and status updates wherever you are,”
said Antony Douglas, head of content at O2.

http://www.telecoms.com/12715/social-networking-driving-mobile-data-boom

How Teenagers Consume Media: the report that shook the City
The US investment bank's European media analysts asked Matthew Robson, an intern
from a London school, to write a report on teenagers' likes and dislikes, which made the
Financial Times' front page today.
His report, that dismissed Twitter and described online advertising as pointless, proved to
be "one of the clearest and most thought-provoking insights we have seen – so we
published it", said Edward Hill-Wood, executive director of Morgan Stanley's European
media team.

http://www.guardian.co.uk/business/2009/jul/13/teenage-media-habits-morgan-stanley

It is essential that the Government puts in place sufficient capability for the police service to
continue its primary duty in protecting our citizens.

The Association of Chief Police Officers (ACPO) is an independent, professionally led strategic body. In the public
interest and, in equal and active partnership with Government and the Association of Police Authorities, ACPO leads
and coordinates the direction and development of the police service in England, Wales and Northern Ireland. In times
of national need ACPO, on behalf of all chief officers, coordinates the strategic policing response.
ACPO is registered as a private company limited by guarantee in England & Wales – registered address: 10 Victoria Street, SW1H 0NN. Company Number
3344583.
Government has already recognised the essential role communications data plays in our policing
activities, and that role has been recognised within various other consultations carried out by
Government-

• development of Part 11 of ATCSA in 2001;

• consultation on the code of practice for the voluntary retention of communications data in
2003;

• consultation concerning the implementation of Chapter 2 of Part I of the Regulation of

Investigatory Powers Act 2000 (RIPA) which governs access to communications data in
2003;

• consultation in 2006 on the code of practice which accompanies Chapter 2 of Part I of the
RIPA and was implemented in 2007;

• consultation of the first phase of implementing the EU DRD (mobile and fixed line
telephony) in 2006 and

• consultation of the final phase of implementing the EU DRD (internet-related data) in 2008.

Question 3 Do you support the Government’s approach to maintaining our

capabilities? Which of the solutions should it adopt?

Doing nothing is clearly not an option for the reasons previously highlighted in this response.

The Government has already announced that it does not propose to pursue the creation of a
central database.

The collaboration of communication providers therefore appears at the heart of the Government’s
proposal to find a “middle way” option. ACPO DCG fully supports engagement with industry
colleagues to develop a better understanding as to what the “middle way” options may look like
and how the shaping of legislation may occur.

ACPO DCG is aware that a limited number of communication providers already collect information
about their customer’s interactions with and within third party services in the online environment as
part of the their research into their customer’s use and viewing preferences, especially information
that enables targeted advertising.

Question 4 Do you believe that the safeguards outlined are sufficient for
communications data in the future?

The process for undertaking the acquisition of communications data under the RIPA regime is
rigorous (as discussed in our response to Question 1) - however other legislation, such as the
Social Security Fraud Act (SSFA), may be used by local authorities for the acquisition of
communications data; that legislation provides little in the way of safeguards or oversight.

There appears, therefore, to be a two tier system operating –

(1) the RIPA tier placing significant bureaucracy and scrutiny process on the law enforcement
and intelligence agencies using their powers which also has a financial implication on staff
resource and then

(2) tier of legislation (such as SSFA) which enables the use of powers to acquire
communications data which-

The Association of Chief Police Officers (ACPO) is an independent, professionally led strategic body. In the public
interest and, in equal and active partnership with Government and the Association of Police Authorities, ACPO leads
and coordinates the direction and development of the police service in England, Wales and Northern Ireland. In times
of national need ACPO, on behalf of all chief officers, coordinates the strategic policing response.
ACPO is registered as a private company limited by guarantee in England & Wales – registered address: 10 Victoria Street, SW1H 0NN. Company Number
3344583.
 • does not require training or accreditation of staff using their powers under the
legiolsation - according to colleagues from communciation providers, the use of such
powers often turn out to be arbitrary, ill-informed and disproportionate;

• has no overseer of the acquisition processes to which CSPs can report errors made by
local authorities;

• has no Tribunal to which members of the public may refer their suspicions about
unlawful or reckless acquisitions of such data;

The absence of safeguards and oversight arrangements for those using legislation, other than
RIPA, to acquire communications data needs to be addressed.

Whilst local authorities may not be given powers within RIPA to acquire communications data
being considered in this consultation, the public will nonetheless, want to be assured by
Government that the use of any statutory powers to acquire communications data are subject to
stringent safeguards and oversight arrangements.

If the Home Office fails to address the disparity in the oversight arrangements one has to anticipate
there will be additional handling difficulties in securing legislation to enable the proposals in this
consultation paper ever being implemented.

Additional Question 1 - Previous public consultations have set out how vital
communications data is to law enforcement, security and intelligence agencies and
emergency services in tackling crime, maintaining our national security and
safeguarding the public. The Government has recently mandated communication
service providers within the UK to retain data they process or generate until they are
required to disclose it-

• Where such communications services do not generate data within the United
Kingdom, do you agree with the Government’s proposal to intervene and develop
a capability enabling law enforcement and the intelligence agencies to respond to
the new communications environment?

• If not, why not and can you suggest another way forward?

• Would restricting access from internet users within the United Kingdom to
communications services situated outside the United Kingdom be justified as a
reasonable alternative?

Major concern was expressed by law enforcement relating to the use of social networking
websites, which appear to fall under the definition of “information society services”. The majority of
issues coming to police attention involving social networking websites were the grooming children
for sexual purposes and suicide interventions.

An information society service is defined in Directive 2000/31/EC as any service normally provided
for remuneration, at a distance, by means of electronic equipment for the processing (including
digital compression) and storage of data, and at the individual request of a recipient of the service.
Directive 02/21/EC provides that an electronic communications service does not include
information society services.

The functionality of a social networking website, where they are no more than an information
society service, appears to be outside the scope of this consultation which is dealing specifically
with communications data derived from activity involving electronic communication services.

However, if the social networking site also includes “communications functionality” then those
elements of the provider’s service fall within the definitions of communications data as set out in
The Association of Chief Police Officers (ACPO) is an independent, professionally led strategic body. In the public
interest and, in equal and active partnership with Government and the Association of Police Authorities, ACPO leads
and coordinates the direction and development of the police service in England, Wales and Northern Ireland. In times
of national need ACPO, on behalf of all chief officers, coordinates the strategic policing response.
ACPO is registered as a private company limited by guarantee in England & Wales – registered address: 10 Victoria Street, SW1H 0NN. Company Number
3344583.
Chapter 2 of Part 1 RIPA.

ACPO DCG will need to be assured that the very rapid growth and use of social networking
websites is taken into account and included within the Government’s final proposals, especially
when most, if not all, of the popular sites are hosted in the United States with no recognised offices
within the United Kingdom.

It may also be appropriate for Government to minimise or discourage or give “pop-up” warnings as
regards access to communication services within the online environment where there is evidence,
which has been presented to a Circuit Judge or Secretary of State, that allowing the public access
to or use of specific communication services could make them vulnerable to fraud, the theft of
personal information or other attack.

Measures already exist to minimise the availability of potentially illegal internet content specifically;

• images of child sexual abuse hosted anywhere in the world

• criminally obscene content hosted in the UK
• incitement to racial hatred content hosted in the UK

http://www.iwf.org.uk/public/page.35.htm

Additional Question 2 - If the Government chose not intervene – do members of law

enforcement perceive there is a current or future threat from such communications
services being openly available for use by criminals (for example sexual offenders
grooming children in the online environment, persons planning or encouraging others
to commit terrorist atrocities, those involved in people and drugs trafficking etc) who
may be able to exploit these facilities in an attempt to circumvent detection?

There is both a current and future threat if the Government does not intervene – there has even
been a risk in the public consultation process, the media coverage and the consequential debates
highlighting, to the criminal elements, that access to third party services is very difficult for law
enforcement to deal with and there is potential circumvention opportunities to be gained from their
use.

It would be amiss of Government to now shelve the development of a capability to deal with these
issues now that they are recorded in a Home Office consultation paper.

Law enforcement have reported that, in their experience, international cooperation to acquire
communications data or other data relating to social networks varies dependent on the country, the
type of incident being investigated, whether the incident is at an investigation stage or whether a
prosecution case file is being completed which involves engagement with the public prosecutor.

Numerous examples were given of the XXXXXX [inter-judicial process with specific country] being
measured in months rather than days or in many cases simply abandoned.

Little if any success has been experienced concerning the XXXXXX [inter-judicial process with
specific country] the service providers in the XXXXXX [name of specific country removed] – the
disclosure required to gain access to, for example itemised billing, would require the equivalent of
a full prosecution file with all witness statements and interview transcripts made available to the
XXXXXX [name of specific country removed] authorities. Evidently, in the early stages of criminal
investigations such a level of detail would simply rule out any approaches being made to the
XXXXXX [name of specific country removed] authorities.

The practice, thus far, has been for ACPO DCG to make direct approaches to service providers
outside UK jurisdiction and set up bilateral agreements on the understanding that disclosure of
communications data will, as a minimum, be used to preserve life or investigate serious crime and
that if the data is required evidentially the [inter-judicial process with specific country] process will

The Association of Chief Police Officers (ACPO) is an independent, professionally led strategic body. In the public
interest and, in equal and active partnership with Government and the Association of Police Authorities, ACPO leads
and coordinates the direction and development of the police service in England, Wales and Northern Ireland. In times
of national need ACPO, on behalf of all chief officers, coordinates the strategic policing response.
ACPO is registered as a private company limited by guarantee in England & Wales – registered address: 10 Victoria Street, SW1H 0NN. Company Number
3344583.
 be undertaken – thus far this has proven successful with XXXXXX, XXXXXX, XXXXXX and others.
XXXXXX [name of specific companies removed]

However, our risk assessments often conclude that no such approach can be made or that
agreements will never be resolved for example, disclosure of information to the hosting state may,
as a consequence, relate to a communications address relating to one of their citizens which could
put that person in a compromised position or even lead to their incarceration by the state.

Additional Question 3 - Do you have examples from recent investigations or operations

where you sought access to communications data where-

• Data was generated or processed (e.g. web-chat, VOIP to VOIP communications)

but it was not retained or retrievable;

• Services accessed by people in the UK but system providing service hosted

outside of the UK had a significant delay or obstruction in acquiring data due to
prolonged or obstructive legal process e.g. social networking websites, e-mail
service provider;

• Services accessed by people in the UK but system providing service hosted

outside of the UK but there was a significant security risk in making an approach
within the hosting state – and so none made;

Examples where data is absent-

• [Example removed]

• [Example removed]

• [Example removed]

Examples where service is hosted abroad-

• [Example removed]

• [Example removed]

• [Example removed]

• [Example removed]

• [Example removed]

• [Example removed]

• [Example removed]

• [Example removed]

Additional Question 4 – Do you consider the current legislation (Part I RIPA which
relates to the (i) interception of communications and (ii) the acquisition and
disclosure of communications data) meets for your operational need, for example-

The Association of Chief Police Officers (ACPO) is an independent, professionally led strategic body. In the public
interest and, in equal and active partnership with Government and the Association of Police Authorities, ACPO leads
and coordinates the direction and development of the police service in England, Wales and Northern Ireland. In times
of national need ACPO, on behalf of all chief officers, coordinates the strategic policing response.
ACPO is registered as a private company limited by guarantee in England & Wales – registered address: 10 Victoria Street, SW1H 0NN. Company Number
3344583.
 • Having to differentiate between notices and authorisations (despite the
processes set out in the Chapter II Code of Practice which partly reduces
unnecessary bureaucracy for subscriber information);

• End user device (e.g. lap-top) seized for evidence but the communications
service provider and the communications system (containing the electronic mail
sought) are outside of the UK;

ACPO DCG has, for the past 6 years and specifically as a result of the ACPO RIPA Review, been
highlighting the need to amend RIPA to make it fit for purpose and reduce unnecessary
bureaucracy, albeit some issues were addressed in the code of practice published in 2007.

In 2006, the Home Office undertook public consultation considering the draft code of practice
accompanying Chapter 2 of Part 1 RIPA. Additional consultation questions proposed the
introduction of additional statutory purposes relating to where a person is missing or otherwise
unaccounted for and there is a concern for their safety or welfare and the person is not believed to
be missing as a result of crime and where:

(a) the person is under the age of 16; or

(b) a request has been made to an emergency service to find the person by–
(i) a spouse, a partner or close relative or a person who lives in the
same premises, or
(ii) a person responsible for the care and welfare of the missing person (such as the
manager of a hospital or residential care home where the missing person resides);
or
(c) the person is believed lost in a natural disaster or accident; or
(d) the person is the subject of an international missing persons enquiry made
through the International Criminal Police Organisation (Interpol).

In the Government’s published response to the consultation, the specific questions relating to the
additional purpose for obtaining communications data where a person is missing were said to have
received very positive comments to the proposal.

The submissions recognised that the emergency services and in particular the police have great
experience in dealing with missing person enquiries, especially in situations where a missing
person is located by the police and that person does not want their whereabouts to be disclosed to
their family or other people who have reported them as missing to the police.

The IOCCO inspections continue to make comment on their inspection reports about the police
utilising statutory powers that are not necessarily appropriate for the enquiries relating to missing
persons when no crime is suspected or the emergency period has passed.

ACPO would like to be assured that when public consultation has been undertaken and a
favourable response made by Government, that it then seeks to implement the appropriate
legislative measures.

Other outstanding legislative issues are set out below - Home Office has, for the past 4 years,
been indicating that these issues are very significant and will be dealt with as a priority.

• Make amendments to sections 21, 22 and 23 whereby the designated person for
acquisition of communications need only consider whether an application meets the
standards of proportionality and necessity and confirms the requirement for the acquisition
and disclosure of the communications data. Policy effect is to end the designated person
having to differentiate between notices and authorisations;

• Synchronise Chapter 2 of Part 1 (acquisition and disclosure of communications data) with

the secrecy and confidentiality requirements of Chapter 1 of Part 1 (Interception) and Part
The Association of Chief Police Officers (ACPO) is an independent, professionally led strategic body. In the public
interest and, in equal and active partnership with Government and the Association of Police Authorities, ACPO leads
and coordinates the direction and development of the police service in England, Wales and Northern Ireland. In times
of national need ACPO, on behalf of all chief officers, coordinates the strategic policing response.
ACPO is registered as a private company limited by guarantee in England & Wales – registered address: 10 Victoria Street, SW1H 0NN. Company Number
3344583.
 III (Data Protected by Encryption). Policy effect is to create “tipping off” clause concerning
requirements made on communications providers;

• Expand the definition of ‘prevention or detection of crime’ within RIPA to include both the
seizure and confiscation of criminal assets or introduce additional statutory purpose3. Law
enforcement presently under take acquisition using of other statutory powers which require
Production Order i.e. two weeks of administration and delay. Policy effect is to reduce
unnecessary bureaucracy and bring acquisition of communication data within the RIPA
safeguards and oversight arrangements;

• Provide an additional provision within Part 1 Chapter 1, section 1(5) to include the
acquisition of data residing on a communication providers network within or outside of the
United Kingdom that constitutes the “content of a communication” that is inextricably linked
to or inseparable from an end user device (mobile telephone or laptop etc) that has been
seized as evidence under another statutory power or is in lawful possession of control of
police. Policy effect is to give clear legislation so that a device that has been lawfully
seized can be used to lawfully acquire information that is within the online environment and
inextricably linked to or inseparable from an end user device. Often the case that service of
Production Order on communication provider is futile as it may be impossible for
communication provider to penetrate their customer’s service archive or the service is
hosted abroad.

In conclusion, I am sure many issues and concerns will have been expressed about how the
future CD capability is developed and the legal, operational and privacy consequences that are
intertwined. What also concerns me is the need to acknowledge issues, many highlighted in this
response, that need to be addressed now and within the existing legislation to ensure we have the
capability and capacity to operate within the communications age.

I am content for the Home Office to state in the Government’s response to the public consultation
that ACPO has contributed with a detailed submission.

Our response to the consultation is marked as ‘Restricted’ – however, if the Home Office considers
extracts from the ACPO response would assist the public better understand the issues by inclusion
in the Government’s response to the consultation, please feel free to approach my office to
discuss.

Yours Sincerely

Jim Gamble QPM

Chair of the Data Communications Group

3
to assist in the preparation and execution of—
(i) restraint or confiscation orders under Parts 2, 3 or 4 of the Proceeds of Crime Act 2002,
(ii) civil recovery of property obtained through unlawful conduct under Chapter 2 of Part 5 of that Act, or
(iii) external requests or external orders under the Proceeds of Crime Act 2002 (External Requests and Orders) Order 2005.

The Association of Chief Police Officers (ACPO) is an independent, professionally led strategic body. In the public
interest and, in equal and active partnership with Government and the Association of Police Authorities, ACPO leads
and coordinates the direction and development of the police service in England, Wales and Northern Ireland. In times
of national need ACPO, on behalf of all chief officers, coordinates the strategic policing response.
ACPO is registered as a private company limited by guarantee in England & Wales – registered address: 10 Victoria Street, SW1H 0NN. Company Number
3344583.
List of law enforcement agencies contributing to the ACPO response-

Avon and Somerset Constabulary

Cambridgeshire Constabulary
Child Exploitation & Online Protection Centre
Cleveland Police
Dorset Police
Gangmasters Licensing Authority
Greater Manchester Police
Hampshire Police
National Offender Management Service
Hertfordshire Constabulary
Humberside Police
Kent Police
Ministry of Defence Police and Guarding Agency
Metropolitan Police
Northumbria Police
Northamptonshire Police
Royal Mail Investigations
South Wales Police
South Yorkshire Police
Surrey Police
Sussex Police
Thames Valley Police
West Yorkshire Police

The Association of Chief Police Officers (ACPO) is an independent, professionally led strategic body. In the public
interest and, in equal and active partnership with Government and the Association of Police Authorities, ACPO leads
and coordinates the direction and development of the police service in England, Wales and Northern Ireland. In times
of national need ACPO, on behalf of all chief officers, coordinates the strategic policing response.
ACPO is registered as a private company limited by guarantee in England & Wales – registered address: 10 Victoria Street, SW1H 0NN. Company Number
3344583.