Regulation of Investigatory Powers Act 2000 Steve Kensington

Regulation of Investigatory Powers Act 2000 Steve Kensington Head of Community Safety 2019 RIPA 2000

Human Rights Act 1998 The Human Rights Act 1998 imposes a duty upon the Council to act in a way that is compatible with the rights under ECHR. Failure to do so may enable a person to seek damages against the Council or to use our failure as a defence in any proceedings that we may bring against them. Article 6 everyone is entitled to a fair and public hearing, within a reasonable time, of any criminal charge against him or her or into the determination of any civil dispute. RIPA 2000

Human Rights Act 1998 Article 8 everyone also has the right to respect for their private and family life, their home and their correspondence. The Article recognises that there may be circumstances in a democratic society where it may be necessary for the State (which includes the Council) to interfere with this right. This can only be done in accordance with the law and for clearly defined purposes. In the interest of national security; In the interest of public safety; In the interest of the economic well-being of the country; For the prevention or detection of crime or of preventing disorder; The protection of health or morals; For the purposes of assessing or collecting any tax, levy or other imposition, contribution or charge payable to a government department; For the purpose, in emergency, of preventing death or injury or any damage to a person’s physical or mental health, or mitigating the same; For any other purpose as specified by the Secretary of State. RIPA 2000

The Introduction of RIPA was introduced for two reasons: To regulate and make compatible with Human Rights legislation the use of various investigatory powers by those involved in the enforcement of law and To ensure public authorities that enforce the law have the powers to fulfil their role effectively. RIPA 2000

General Principles Necessary Proportionate Not of excessive duration RIPA 2000

Authorisations The acquisition of communications data Intrusive surveillance from either residential premises or in private vehicles; * Covert surveillance in the course of specific operations; The use of Covert Human Intelligence Sources, ‘CHIS’, such as agents, informants and undercover officers; Access to encrypted data. RIPA 2000

Authorising Direct Surveillance Application be made before the surveillance takes place Judicial Approval required Authorisation lasts 3 months Should be regularly reviewed Must be cancelled as soon as it is no longer required *only Chief Executive can authorise acquisition of Confidential Information RIPA 2000

Covert Human Intelligence Source - CHIS The source establishes or maintains a personal or other relationship with a person in order to Covertly obtain information or provide access to information to another person; or Covertly disclose information obtained by the use of such a relationship or as a consequence of the existence of such a relationship RIPA 2000

Authorising a CHIS Judicial Approval required Authorisations last no longer than 12 months Should be regularly reviewed The Identity of CHIS must be protected by their ‘handler’ Must be cancelled as soon as it is no longer required RIPA 2000

Communications Data Communications data does not include the contents of any telephone or email communication but does include: Information about communications (traffic data)* Information about the use of communications services (service use data) Information about communications service users (subscriber data) RIPA 2000

Authorising Communications Data Initial application must be made through the Single Point of Contact to NAFN Judicial Approval required Authorisations last 1 month Must be cancelled as soon as it is no longer required RIPA 2000

Use of Social Media Obtaining evidence through the use of Social Media is often most the useful tool but requires particular care. It may be challenged or even considered inadmissible if we are unable to demonstrate that it was obtained correctly. RIPA 2000

IPCO Guidance The fact that digital investigation is routine or easy to condone does not reduce the need for authorisation under RIPA. Care must be taken to understand how the SNS being used works. Authorising officers must not be tempted to assume that one service provider is the same as another or that the services provided by a single provider are the same. Whilst it is the responsibility of an individual to set privacy settings to protect unsolicited access to private information, and even though data may be deemed published and no longer under the control of the author, it is unwise to regard SNS data as ‘open source’ or publicly available. The author has a reasonable expectation of privacy if access controls are applied. RIPA 2000

IPCO Guidance In some cases data may be deemed private communication still in transmission (instant messages for example). Where privacy settings are available but not applied the data may be considered open source and an authorisation is not usually required. It is not unlawful for a member of a public authority to set up a false identity but it is inadvisable for a member of a public authority to do so for a covert purpose without an authorisation for directed surveillance when private information is likely to be obtained. A member of a public authority should not adopt the identity of a person known, or likely to be known, to the subject of interest or users of the site without authorisation, and without the consent of the person whose identity is used, and without considering the protection of that person. The consent must be explicit (i. e. the person from whom consent is sought must agree (preferably in writing) what is and is not to be done). RIPA 2000

Authorisation Process 1. Establish the need for Directed Surveillance, use of a CHIS or access to restricted Communications Data. 2. Consider whether the required evidence could be obtained by other less intrusive means and whether the intended action is justified and proportionate to the offences being investigated 3. In doing so consider the likelihood of the offence, its seriousness and the available penalty (i. e. >=6 months Imprisonment? ) 4. The case officer should always discuss this with their team leader before planning any detailed investigation or considering the use of RIPA 2000

Authorisation Process If agreed that this investigation is warranted: 5. Case Officer (CO) to draft the appropriate RIPA application having regard to the councils Policy & Protocol and other available guidance. Sufficient detail should be provided to evidence and justify the need for the action being proposed 6. Obtain a unique RIPA reference number from the Chief Legal Officer 7. Ensure that the full details and dates of the intended surveillance / use of CHIS are included in the application. Also specify the date for review and expiry of the authorisation if granted RIPA 2000

Authorisation Process 8. Submit application to Authorising Officer (AO) for consideration (See list of Authorising Officers on website). 9. If agreed, the AO will add comments and justification before formal approval. 10. CO to complete a Judicial Approval application form and arrange for hearing with a Justice of the Peace via Magistrates Court. 11. CO to attend Magistrates Court as arranged and present case for RIPA authorisation to JP. RIPA 2000

Authorisation Process 12. If approved the JP will sign and date the Judicial Approval application form, which also should be sealed by the court. This is then retained by the CO and a copy sent to the RIPA Co-ordinating Officer and Chief Legal Officer. 13. Originals of all paperwork to be retained within the investigation file. 14. CO to develop any necessary ‘Operational Plans’ or Risk Assessments which must be agreed and signed off by appropriate Team Leader. 15. CO to implement investigative action within the terms agreed and authorised under RIPA. Note: There must be no departure from this without a further RIPA authorisation. RIPA 2000

Authorisation Process 16. If investigation is successful then RIPA authorisation should be cancelled and this recorded and signed off on the original authorisation form. 17. Advise both RIPA Co-ordinating Officer and Chief Legal Officer without delay to enable updating of the RIPA register. 18. If the authorised operation has been unsuccessful but further action is authorised under the current RIPA application then ensure that a RIPA review is carried out at the appropriate time using the appropriate form. 19. Send a copy of the signed Review form to the Chief Legal Officer 20. If further Directed Surveillance; use of a CHIS; obtaining of Communications data is needed as part of an on-going investigation, and this does not form part of the original authorisation, then a further RIPA application and authorisation is required in every case. (Including a fresh Judicial Approval. ) RIPA 2000

Authorisation Process REMEMBER: The RIPA applicant (CO) is in the first instance responsible for compliance under RIPA. This includes: Meeting RIPA application and authorisation requirements The implementation of the authorised action in accordance with the RIPA approval. Cancellation of the RIPA authorisation when no longer required. Scheduling and carrying out reviews where appropriate. Advising the council’s RIPA Co-ordinating Officer and Chief Legal Officer of actions taken including investigation outcomes i. e. the success of the investigation and subsequent action to be taken. (Prosecution? ) (Caution? ) (NFA? ) (Insufficient evidence obtained? ) RIPA 2000

Quality Assurance 1. Case Officer consultation with Team Leader 2. If approved, further consultation with Department Head of Service and RIPA Co-ordinating Officer 3. Document signed by CO and AO 4. Signed, sealed Judicial Approval 5. Cancellation by CO Chief Legal Officer and RIPA Co-ordinating Officer updated at all points RIPA 2000

Authorising Officers Designation Officer Notes Chief Executive Susie Kemp Includes acquiring Confidential Information and use of juveniles or vulnerable persons as a CHIS. Chief Legal Officer Lisa Hall Senior Responsible Officer for RIPA. Only authorise in exceptional circumstances Corporate Director: Community and Housing Steve Jorden Head of Community Safety Steve Kensington Head of Planning, Regulatory Services and Heritage Richard Bell Head of Housing Services Mike Ash Director of Adult Services Sue Wald Director of Children’s Services David Haley RIPA Co-ordinating Officer and SPOC for acquiring Communications Data RIPA 2000