Use of cloud analytics / extraction
Dear Police Service of Northern Ireland,
I am aware that companies are selling technologies to law enforcement that allow them to take vast quantities of personal data from cloud-based apps and accounts. You can read more [https://privacyinternational.org/long-re....
I make the following request for documents/information under the Freedom of Information Act:
1. Do you use mobile phone extraction technology that includes cloud analytics / cloud extraction capabilities e.g. Cellebrite UFED Cloud Analyser, Magnet Axiom Cloud or Oxygen Forensics Cloud Extractor
2. Do you have other technologies that allow you to access cloud-based accounts and extract this data.
3. Please provide a copy of the relevant Data Protection Impact Assessment.
4. Please provide a copy of the relevant local and/or national guidance/standard operating procedure/policy.
5. Please confirm the legal basis you rely on to conduct cloud analytics/extraction.
Yours faithfully,
Abdul Hai
This e-mail has been marked OFFICIAL [PUBLIC];
29th January 2020
Dear Mr. Hai,
FREEDOM of INFORMATION ACT 2000
I write in connection with your request for information dated 29th January
2020 which was received by the Police Service of Northern Ireland (PSNI)
on 29th January 2020. I note you seek access to the following
information:
Use Of Cloud Analytics / Extraction
This request will be dealt with under the terms of the Freedom of
Information Act 2000. A response should be sent to you within 20 working
days however I would like to advise you that PSNI are currently
experiencing a delay in the processing of requests and we aim to respond
to your request as soon as possible.
If your request is unclear and clarification is required the 20 day
legislative time limit dictated by the Freedom of Information Act 2000
will be stopped until we receive clarification of your request. The ICO
guidance at paragraph 40 of the link below sets out that the clock begins
anew the day after the clarification is received. It states
“If the requester subsequently provides enough detail to enable the
authority to identify and locate the information, then the authority must
respond to the clarified request within a new 20 working day time limit
with the ‘clock’ starting the day after it receives the required
clarification. “
The link for this is:
[1]https://ico.org.uk/media/for-organisatio...
In the event where the cost of complying with the request would exceed the
“appropriate level”, which is fixed at £450, as stated in the Freedom of
Information Regulations 2004, it is the policy of the PSNI to close the
request. You will however be notified of this decision and given an
opportunity to refine and resubmit the request.
If your request requires either full or partial transference to another
public authority in order to answer your query, again, you will be
notified.
If you have any queries regarding your request please write or contact the
Corporate Information Branch on 028 9070 0164. Please remember to quote
the reference number listed above in any future communications with the
Corporate Information Branch.
If you are dissatisfied in any way with the handling of your request, you
have the right to request a review. You should do this as soon as
possible, or in any case within two months of the date of issue of this
letter. In the event that you require a review to be undertaken, you can
do so by writing to the Head of Corporate Information Branch, PSNI
Headquarters, 65 Knock Road, Belfast, BT5 6LE or by emailing
[email address].
If following an internal review, carried out by an independent decision
maker, you were to remain dissatisfied in any way with the handling of the
request you may make a complaint, under Section 50 of the Freedom of
Information Act, to the Information Commissioner’s Office and ask that
they investigate whether the PSNI has complied with the terms of the
Freedom of Information Act. You can write to the Information Commissioner
at Information Commissioner’s Office, Wycliffe House, Water Lane,
Wilmslow, Cheshire, SK9 5AF. In most circumstances the Information
Commissioner will not investigate a complaint unless an internal review
procedure has been carried out, however the Commissioner has the option to
investigate the matter at his discretion.
Yours sincerely,
Alison
FOI Decision Maker
Corporate Information Branch
PSNI HQ Brooklyn
References
Visible links
1. https://ico.org.uk/media/for-organisatio...
This e-mail has been marked OFFICIAL [PUBLIC];
Subject:FOI-2020-00298
6th March 2020
Dear Mr. Hai,
FREEDOM of INFORMATION ACT 2000
I write in connection with your request for information dated 29th January
2020 which was received by the Police
Service of Northern Ireland on 29th January 2020 concerning:
Use Of Cloud Analytics / Extraction
Please find attached response to your request.
Yours sincerely,
FOI Decision Maker
Corporate Information Branch
PSNI HQ Brooklyn
We work to defend the right to FOI for everyone
Help us protect your right to hold public authorities to account. Donate and support our work.
Donate Now
J Roberts left an annotation ()
You may be interested in this ICO report:
Mobile phone data extraction by police in Northern Ireland
Investigation report June 2021
'This new report outlines concerns around the Police Service of Northern Ireland’s compliance with data protection legislation, and requires an urgent response. Recommendations include carrying out a data protection impact assessment, clarifying their lawful basis for processing, improving their policies and training for staff, and improving transparency.
2.1 Overview
The PSNI has a Cyber Support Unit (CSU) that provides the forensic MPE capability within the organisation.The CSU has up to 60 full-time trained operators across four sites in Northern Ireland. These operators perform extractions, review the results and generate reports for the officer in charge (OIC) of the investigation to review.
...
We are significantly concerned that the PSNI does not have an overarching policy in relation to its use of MPE technology. As a result, the information we obtained during this investigation was as a result of the investigation team engaging in dialogue with the organisation’s officers.'
https://ico.org.uk/media/about-the-ico/d...
MPE = mobile phome extraction
Other ICO reports:
https://ico.org.uk/about-the-ico/what-we...