Social Media Monitoring

The request was successful.

Dear Sir/Madam,

Freedom of information act request

RE: Social media monitoring / social media intelligence

FOIA REQUEST

For definition of social media intelligence please see background explanation below. We further note the comments of the Office of Surveillance Commissioners Annual Report 2016 cited below.

1. In 2016 the Rt Hon Lord Judge, then Chief Surveillance Commissioner, wrote to all Local Authorities regarding use of social media in investigations. Please confirm whether you are aware you received this letter and:
(a) Provide a copy of your response; (please confirm if you did not respond)

(b) Provide a copy of any internal audit relating to social media use arising out of Rt Hon Lord Judge’s recommendations; (please confirm if you did not conduct an internal audit and state whether any internal audit of social media use has taken place since 2016).

(c) Provide a copy of your corporate policy on the use of social media in investigations. (please confirm if you do not have one)

(d) Please confirm whether a follow up audit was conducted by the Surveillance Commissioner’s Office which was exclusively or partially related to social media use in investigations by your Local Authority.

2. Does your Local Authority conduct overt and/or covert social media intelligence in some or all of its work?

(a) If yes, please specify whether this includes profiling individuals, conducting investigations, monitoring individuals, monitoring groups, monitoring locations, gathering intelligence, for recruitment purposes.

(b) If your Local Authority does conduct social media intelligence/monitoring, please specify whether this includes both or either overt or covert monitoring of social media.

(c) If the Local Authority has conducted covert social media monitoring, please confirm the number of RIPA warrants obtained in the last two years for this purpose.

3. If the Local Authority conducts social media intelligence, please provide a copy of any current guidance/policies/internal guidance/code of practice or any other such written material used by/available to the local authority or those working on behalf of the local authority to conduct SOCMINT, the monitoring or accessing of information published on social media that is either publicly available or requires additional access e.g. to be friends with an individual, to have password and login details.

4. If you conduct overt or covert social media intelligence relating to social media platforms, please provide a copy of:
(a) Relevant [sections of the] privacy policy;
(b) the data protection impact assessment;
(c) privacy impact assessment;
(d) equality and human rights impact assessment
(e) training materials for those conducting social media intelligence.

Please state if you do not have any of the above.

5. Please provide a copy of any other template/form/document currently used (or to be used with the next three months) by the local authority or fraud investigator (or team) in the conduct of social media monitoring

6. Please confirm whether or not your local authority has purchased or uses software and/or hardware to conduct social network / social media monitoring and/or in relation to sentiment analysis.

(a) If yes, please state the name of the company / provider.

(b) If no, please state whether the local authority has developed internal methods to conduct social media / social network monitoring.

7. Please confirm, if not stated in the guidance (question 3), the policy on deletion of data obtained from social networking sites.

8. If no documents (question 3) exist, or if the following is not covered in the documents which do exist, please explain:
a. In what areas of the local authority's work is social media monitoring used
b. What criteria must be satisfied in order for social media monitoring to be carried out
c. Who must authorise the request to conduct social media monitoring
d. What is the process for conducting social media monitoring
e. How long is data collected and retained?
f. Is there any process for requesting deletion?

9. Are you able to state how regularly social media monitoring is used? If so, please provide the figures.

Kind regards,

Camilla Graham Wood

-----------

Background explanation: What is social media intelligence

This is a Freedom of Information Act request in relation to social media intelligence. Social media intelligence (SOCMINT) can also be referred to as social media monitoring, social network monitoring, social media listening, open source intelligence (OSINT) (focusing on social media platforms). Reference to SOCMINT in this FOIA request encompasses all these and any other terminology used to describe the viewing, collection, retention and analysis of data on social media platforms.

SOCMINT refers to the techniques and technologies that allow the monitoring and gathering of information on social media platforms such as Facebook, Twitter and Instagram. SOCMINT includes monitoring of content, such as messages or images posted, and other data, which is generated when someone uses a social media networking site i.e. meta data like location information. This information involves person-to-person, person-to-group, group-to-group and includes interactions that are private and public.

The methods for analysing social media networking sites vary. Methods may include manually reviewing content as it is posted in public or private groups or pages; reviewing the results of searches and queries of users; reviewing the activities or types of content users post; or 'scraping' - extracting the content of a web page - and replicating content in ways that are directly accessible to the person gathering social media intelligence.

It may include looking at content posted to public or private groups or pages. it may also involve "scraping" or grabbing all the data from a social media platform, including content and individual post and data about their behaviour (likes and shares). Through scraping and other tools, SOCMINT permits the collection and analysis of a large pool of social media data, which can be used to generate profiles and predictions about users.

We are sending this FOIA request to you as a local authority being either a London borough, metropolitan district, unitary authority, district council or county council.

Background explanation: Surveillance Commissioner Annual Reports

The Chief Surveillance Commissioner The Rt Hon Sir Christopher Rose’s Annual Report first referred to social network sites in 2012-13 stating that:

“2.4 All public authorities have struggled with the use of the Internet for investigations, particularly social network sites. A particular difficulty is the desire of national bodies to apply a doctrinaire approach which invites error if facts specific to each case are ignored or poorly considered.”

The subsequent report 2013 – 2014 stated that:

“5.30 … Although there remains a significant debate as to how anything made publicly available in this medium can be considered private, my Commissioners remain of the view that the repeat viewing of individual “open source” sites for the purpose of intelligence gathering and data collation should be considered within the context of the protection that RIPA affords to such activity.

5.31 In cash-strapped public authorities, it might be tempting to conduct online investigations from a desktop, as this saves time and money, and often provides far more detail about someone’s personal lifestyle, employment, associates etc. But just because one can, do not mean one should. The same considerations of privacy and especially collateral intrusion against innocent parties, must be applied regardless of the technological advances. It is worth repeating something I said in my 2011-2012 report, paragraph 5.8:

“There is a fine line between general observation, systematic observation and research and it is unwise to rely on a perception of a person’s reasonable expectation or their ability to control their personal data. Like ANPR and CCTV, the Internet is a useful investigative tool but they each operate in domains which are public and private. As with ANPR and CCTV, it is inappropriate to define surveillance solely by the device used; the act of surveillance is of primary consideration and this is defined at section 48(2-4) of RIPA (monitoring, observing, listening and recording by or with the assistance of a surveillance device). The Internet is a surveillance device as defined by RIPA section 48(1). Surveillance is covert “if, and only if, it is conducted in a manner that is calculated to ensure that persons who are subject to the surveillance are unaware that it is, or may be taking place.” Knowing that something is capable of happening is not the same as an awareness that it is or may be taking place. The ease with which an activity meets the legislative threshold demands improved supervision.”

The final report of the Chief Surveillance Commissioner in 2016 , before this was abolished and replaced by the IPCO stated:

“4.3 From time to time my Inspectorate is asked why, given that no authorisation has been granted by an individual authority since the previous inspection some three years earlier, the process of inspection and oversight is necessary. The short answer is unequivocal. While local authorities remain vested with the power to deploy covert surveillance, regardless of actual use, the appropriate structures and training must remain in place so that if and when the powers do come to be exercised, as they may have to be in an unexpected and possibly emergency situation, the exercise will be lawful. So, for that reason alone the process of inspection must continue. There is a further consideration. The inspection may reveal inadvertent use and misuse of the legislative powers. The steady expansion in the use of the social media and Internet for the purposes of investigative work provides a striking example of a potential new problem which came to light through the inspection system. Local authority officials, vested with burdensome responsibilities for, among others, the care of children and vulnerable adults, are, like everyone else, permitted to look at whatever material an individual may have chosen to put in the public domain. This is entirely lawful, and requires no authorisation. However, repeated visits to individual sites may develop into an activity which, if it is to continue lawfully, would require appropriate authorisations. Local authorities must therefore put in place arrangements for training officials into a high level of awareness of these risks. Without the inspection process this problem might never have been identified.

15.2 As discussed earlier one major consequence of the OSC inspections has been the emergence, during the course of discussions, of investigations being made by public authorities through use of social media and the Internet. For example, it may help to show whether counterfeit good are being offered for sale on a Facebook page, or reveal that someone who claims to be living alone as a single parent has a social media page which provides a different story, or perhaps, particularly sensitive, enable a check to be made whether concerns about the welfare of a child or vulnerable adult may be justified. When individuals choose to go public or advertise themselves, they cannot normally complaint that those who look at their social media sites are disregarding their rights to privacy. However if the study of an individual site becomes persistent, issues under the legislation may arise.

15.3 The resources available to the OSC do not enable me to say positively that issues relating to the use of social media sites have arisen or are arising in every local authority. What matters is that this potential certainly exists. Senior officials at local authorities should therefore be made aware of it and have the necessary policy documents and training and awareness arrangements in place to address it. This issue has been recognised in the forthcoming Home Office and Scottish Government Codes of Practice (which will be issued at a convenient date after the introduction of the Investigatory Powers Act 2016). However, in advance of the issue, and because of repeated findings in reports made to me by Inspectors and Assistant Surveillance Commissioners throughout this year, I acted on my own initiative. I therefore wrote to all local authorities in April 2017 explaining my concerns, and urging them to undertake internal checks of the use of social media by no doubt well-intentioned members of their staff, and to ensure that appropriate guidance and training should be provided.

15.4 An extract from the letter reads:

“it has become steadily more apparent that a number of officers working for public authorities, particularly those with responsibilities for the care of children and vulnerable adults have started to use the [social media and internet] sits, acting in good faith and on their own initiative. RIPA issues do not normally arise at the start of any investigation which involves accessing “open source” material, but what may begin as lawful overt investigation can drift into cover surveillance which falls within the legislation. Although the investigation of crime is not normally a “core function” of the Council, the protection of children and vulnerable adults certainly is, and any continuing and deeper study of the social media site in question would only be justified by the exercise of that protective function.

These are complex legislative provisions, and without appropriate training and awareness council officers cannot be expected to appreciate and apply them. They may therefore act unlawfully. Ignorance would provide no defence to them personally, nor to the Council for which they were working.

The Surveillance Commissioners have issued further guidance on this issue, and identified circumstances when an appropriate authorisations under the legislation would be required or advisable. The guidance is available on the OSC website as a public document, with the OSC Procedures Guidance. Note 289 is relevant and I highlight it for your attention.

It would be sensible for an internal audit of the use of social media sites and Internet for investigative or official business made across all departments be undertaken now. That would provide the necessary information about the extent to which formal training or awareness of these complex provisions is required.”

15.5 A copy of this letter was sent to the Chair of the Local Government Association and the national police lead for child protection issues, Chief Constable Simon Bailey of the Norfolk Constabulary.

15.6 As I reported last year, many local authorities have first-class arrangements in place for the use of covert tactics, even if, as a matter of policy, they do not intend to deploy them: others do not. Where necessary arrangements to ensure compliance are not in place, I require a report from the Chief Executive after a given period, say six months, about how the inadequacies have been addressed, and indicating that a further inspection may have to be arranged. There have been, and will continue to be occasional inspection revisits. One such revisit will have taken place by the time this report is published. I should, however, highlight that the problem of the non-compliant local authority should be kept in perspective. These authorities very rarely use or attempt to use statutory powers, and the occasions when they have been in breach of the legislative provisions remain very rare indeed. The point, as one of my Inspectors helpfully paraphrased it, is that while they are vested with these significant powers they should remain “match fit”. The inspection process provides both an encouragement and a check that they are.

The Investigatory Powers Commissioner replaced the Surveillance Commissioner. The Investigatory Powers Commissioner, Sir Adrian Fulford’s Annual Report 2017 states:

4.37 Local authority guidance on surveillance does not always address how investigators should use social media or where they may need an authorisation. The 2018 revised Home Office code of practice for surveillance contains helpful advice local authorities can incorporate into their policy documents and training.

4.38 Our inspectors were particularly impressed by Durham Country Council, whose senior responsible officer commissioned a helpful audit across the organisation on the “Use of social media in Covert Investigations’, to evaluate and report their system is adequate and appropriate for this purpose. We commend this approach.

Northumberland County Council

1 Attachment

Our Ref: 6765  

Dear Enquirer,

INFORMATION REQUEST

Thank you for your request for information which will be dealt with under
the terms of the Freedom of Information Act 2000 / Environmental
Information Regulations 2004.

In some circumstances a fee may be payable and if that is the case, we
will let you know the likely charges before proceeding.

If you have any queries about this matter please contact us. Please
remember to quote the reference number above in any future communications.

Kind regards

Information Governance Office
Northumberland County Council
County Hall
Morpeth
Northumberland
NE61 2EF

Tel: 0345 600 6400
Email: [Northumberland County Council request email]
Web: http://www.northumberland.gov.uk

Northumberland County Council

4 Attachments

Ref: 6765

Dear Enquirer,

FREEDOM OF INFORMATION ACT REQUEST 

I refer to your Freedom of Information request for details Social Media
Monitoring. 

Right of Access

Section 1(1) of the Act provides any person making a request for
information to a public authority is entitled. 

(a) to be informed in writing by the public authority whether it holds
information of the description specified in the request (which Section
1(6) of the Act designates as the "duty to confirm or deny"), and 

(b) if that is the case, to have that information communicated to him. 

The right is to obtain access to the information itself and not to the
document or record which contains it. 

The Act creates a general right of access to information held by public
authorities subject to various exemptions. 

Northumberland County Council confirms that it holds the information you
have requested, please see the following information and attachments in
response. 

Q.1 In 2016 the Rt Hon Lord Judge, then Chief Surveillance Commissioner,
wrote to all Local Authorities regarding use of social media in
investigations. Please confirm whether you are aware you received this
letter and:

A.1 Yes

Q.1a Provide a copy of your response; (please confirm if you did not
respond)

A.1a No response issued.

Q.1b Provide a copy of any internal audit relating to social media use
arising out of Rt Hon Lord Judge’s recommendations; (please confirm if you
did not conduct an internal audit and state whether any internal audit of
social media use has taken place since 2016).

A.1b There has been no internal audit relating to social media in the
period requested. 

Q.1c Provide a copy of your corporate policy on the use of social media in
investigations. (please confirm if you do not have one)

A.1c We have attached a copy of the organisation’s Social Networking
Policy, Code of Conduct and the Disciplinary policy from our HR department
that covers the use of social media by Council employees.

Our policy regarding social media in investigations used by our Public
Protection team covering investigations of the wider general public cannot
be released as it includes information about investigation methods and
equipment used. This information is exempt under S.31(1), please see the
detailed exemption description below.

 

Q.1d Please confirm whether a follow up audit was conducted by the
Surveillance Commissioner’s Office which was exclusively or partially
related to social media use in investigations by your Local Authority.

A.1d No information held

Q.2 Does your Local Authority conduct overt and/or covert social media
intelligence in some or all of its work?

A.2 Yes

Q.2a If yes, please specify whether this includes profiling individuals,
conducting investigations, monitoring individuals, monitoring groups,
monitoring locations, gathering intelligence, for recruitment purposes.

A.2a Human Resources will investigate if a concern is raised by a 3rd
party as to the appropriateness of comments made on social media by a
Council employee, the organisation may view an individual’s social media
account in line with the attached Social Networking policy. If it is
determined that an investigation is needed then that evidence will be used
as part of that formal process.

The Public Protection team use it for the following purposes; conducting
investigations, monitoring individuals, gathering intelligence.

Q.2b If your Local Authority does conduct social media
intelligence/monitoring, please specify whether this includes both or
either overt or covert monitoring of social media.

A.2b Both overt and covert monitoring.

Q.2c If the Local Authority has conducted covert social media monitoring,
please confirm the number of RIPA warrants obtained in the last two years
for this purpose.

A.2c None in the last 2 years.

Q.3 If the Local Authority conducts social media intelligence, please
provide a copy of any current guidance/policies/internal guidance/code of
practice or any other such written material used by/available to the local
authority or those working on behalf of the local authority to conduct
SOCMINT, the monitoring or accessing of information published on social
media that is either publicly available or requires additional access e.g.
to be friends with an individual, to have password and login details.

A.3 This information is exempt under S.31(1), please see below.

Q.4 If you conduct overt or covert social media intelligence relating to
social media platforms, please provide a copy of:

(a) Relevant [sections of the] privacy policy;

(b) the data protection impact assessment;

(c) privacy impact assessment;

(d) equality and human rights impact assessment

(e) training materials for those conducting social media intelligence.

Please state if you do not have any of the above.

A.4 This information is exempt under S.31(1), please see below.

Q.5 Please provide a copy of any other template/form/document currently
used (or to be used with the next three months) by the local authority or
fraud investigator (or team) in the conduct of social media monitoring

A.5 No formal template exists, however where there is a suspected breach
of the Social Networking policy and a formal investigation is required the
attached policies will apply.

Q.6 Please confirm whether or not your local authority has purchased or
uses software and/or hardware to conduct social network / social media
monitoring and/or in relation to sentiment analysis.

A.6 We have not purchased hardware or software to conduct such monitoring.
We do use specialist software to secure evidence. 

Q.6a If yes, please state the name of the company / provider.

A.6a This information is exempt under S.31(1), please see below.

 

Q.6b If no, please state whether the local authority has developed
internal methods to conduct social media / social network monitoring.

A.6b This information is exempt under S.31(1), please see below.

 

Q.7 Please confirm, if not stated in the guidance (question 3), the policy
on deletion of data obtained from social networking sites.

A.7 Evidence is retained for 6 years from the date of last use. For
example, if a matter results in a prosecution it will be retained for 6
years from the date of the last associated court hearing.

Q.8 If no documents (question 3) exist, or if the following is not covered
in the documents which do exist, please explain:

Q.8a In what areas of the local authority's work is social media
monitoring used

A.8a Trading Standards

 

Q.8b What criteria must be satisfied in order for social media monitoring
to be carried out

A.8b This information is exempt under S.31(1), please see below.  The
criteria applied are the same for any directed surveillance authorisation
and have regard to necessity, proportionality and collateral intrusion.

 

Q.8c Who must authorise the request to conduct social media monitoring

A.8c The same Authorising Officers responsible for authorising any
directed surveillance.

Q.8d What is the process for conducting social media monitoring

A.8d This information is exempt under S.31(1), please see below.

 

Q.8e How long is data collected and retained?

A.8e This information is exempt under S.31(1), please see below.

Q.8f Is there any process for requesting deletion?

A.8f The Authority will consider any request for deletion in the context
of its obligations under the Data Protection Act 2018, bearing in mind the
exemptions set out in Section 45(4).

Q.9 Are you able to state how regularly social media monitoring is used?
If so, please provide the figures. 

A.9 Social media monitoring is used infrequently and has not been used in
the last two years.

Duty to confirm or deny 

We hold the information you requested. However we are withholding that
information since we consider that the exemption under Section 31(1)(a)
applies. 

 

Exemptions 

The Freedom of Information Act sets out various exemptions to the right of
access. 

In the present case the County Council takes the view that the information
relating to your request is exempt under the following provisions; 

31 Law enforcement. 

(1) Information which is not exempt information by virtue of section 30 is
exempt information if its disclosure under this Act would, or would be
likely to, prejudice— 

(a) the prevention or detection of crime, 

(b) the apprehension or prosecution of offenders, 

(c) the administration of justice, 

Notice of Refusal 

Please treat this letter as a Notice of Refusal as regards the information
covered by the Section 31 Exemption. 

Public interest considerations 

Although there is a clear public interest in protecting the ability of
public authorities to perform their law enforcement activities, we
consider that the public interest in maintaining the exemption outweighs
the public interest in disclosing the information because it refers to
equipment and software used in the course of investigations. Releasing
such information would undermine our ability to conduct such
investigations as criminals may develop practices to undermine or reduce
the effectiveness of our investigatory methods.  

Advice and Assistance 

The County Council recognises its statutory duty to provide advice and
assistance under Section 16 of the Act. 

Subject to the provisions of the Freedom of Information Act, the Council
is seeking to be transparent and open in its response. 

Complaints

If you are unhappy with the way your request for information has been
handled, you can request an internal review by writing within 2 months
from the date of this response to the Information Governance Office: 

Information Governance Office

Northumberland County Council

County Hall

Morpeth

NE61 2EF 

Email: [Northumberland County Council request email] 

Information Commissioner 

If you remain dissatisfied with the handling of your request or complaint,
you have a right by Section 50 of the Act to apply to the Information
Commissioner for a decision as to whether your request has been dealt with
in accordance with the requirements of the Act at: 

The Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF 

Tel: 0303 123 1113

Email: [email address

There is no charge for making an appeal 

Yours faithfully 

FOI Coordinator - Central Team

Information Governance Office

Northumberland County Council

County Hall

Morpeth

Northumberland

NE61 2EF

Tel: 0345 600 6400

Email: [Northumberland County Council request email] 

Web: http://www.northumberland.gov.uk

Dear Northumberland County Council,

Thank you for your response.

Yours faithfully,

Millie