Use of cloud analytics / extraction
Dear Essex Police,
I am aware that companies are selling technologies to law enforcement that allow them to take vast quantities of personal data from cloud-based apps and accounts. You can read more [https://privacyinternational.org/long-re....
I make the following request for documents/information under the Freedom of Information Act:
1. Do you use mobile phone extraction technology that includes cloud analytics / cloud extraction capabilities e.g. Cellebrite UFED Cloud Analyser, Magnet Axiom Cloud or Oxygen Forensics Cloud Extractor
2. Do you have other technologies that allow you to access cloud-based accounts and extract this data.
3. Please provide a copy of the relevant Data Protection Impact Assessment.
4. Please provide a copy of the relevant local and/or national guidance/standard operating procedure/policy.
5. Please confirm the legal basis you rely on to conduct cloud analytics/extraction.
Yours faithfully,
Abdul Hai
Thank you for your enquiry which has been logged under the above
reference.
Under the Freedom of Information Act we are required to reply within 20
working days. The Act does not specify a limit to the number of
information requests a public authority may receive or the number of
requests or questions an applicant may submit. However, there are
exemptions in the Act that can apply and these include where the cost of
complying with the request would extend beyond the reasonable cost limit,
(currently 18 hours or £450), or if the request is otherwise manifestly
unreasonable in its scope or nature.
Requests that ask a great many questions, or a number of detailed requests
submitted at the same time, may make it necessary for Essex Police to
refuse the requests wholly or in part. The exemption at s14 may be
engaged if the burden on the authority is increased through multiple
requests on differing subjects
The Information Commissioner’s Office (ICO) has responsibility for
providing oversight and guidance for the legislation and they have
produced advice for applicants on submitting effective requests. Further
information can be found on the Commissioner’s website at
[1]www.ico.gov.uk specific information relating to submitting a request
can be found at:
[2]https://ico.org.uk/for-the-public/offici...
While we process your request, please take the time to consider the ICO’s
advice and whether you feel it may be beneficial to amend or refine your
request. Our team is happy to discuss your request with you and will be
able to provide advice as to what kind of information will be available
from Essex Police.
Kind regards,
Information Rights Team
Information Management Department
Information Rights Section
E-Mail: [3][Essex Police request email]
[4]cid:image001.png@01D3E908.EC4D1080
Please note, if you require further information or wish to resubmit a
request please refer to the information found on the Commissioner’s
website regarding submission of effective requests
[5]https://www.ico.org.uk/for_the_public/of...
Your right to complain
If you feel your request has not been properly handled, or you are
otherwise dissatisfied with the outcome of your request you have the right
to complain.
Complaints should be submitted within 20 working days from the date of
this response and should be addressed to the Senior Information Officer at
the above address or by email to: [6][Essex Police request email]
We will conduct a review to investigate your complaint and endeavour to
reply within 20 working days.
Please explain which aspect of the reply you are not satisfied with, and
if your complaint concerns the decision to apply an exemption it would
assist the review if you would outline why you believe the exemption does
not apply.
If you are still dissatisfied following our review, you have the right
under Section 50 of the Act to complain directly to the Information
Commissioner. Before considering your complaint, the Information
Commissioner would normally expect you to have exhausted the complaints
procedures provided by Essex Police
The Information Commissioner can be contacted at: Information
Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9
5AF or via [7]https://ico.org.uk/
Essex Police refer to your recent request logged under the above reference
and subsequent acknowledgement.
The FOI Act obliges us to respond to requests promptly and in any case no
later than 20 working days after receiving your request. We must consider
firstly whether we can comply with Section 1(1)(a) of the Act, which is
our duty to confirm whether or not the information requested is held and
secondly we must comply with Section 1(1)(b), which is the provision of
such information. However, when a qualified exemption applies either to
the confirmation or denial or the information provision and the public
interest test is engaged, the Act allows the time for response to be
longer than 20 working days, if the balance of such public interest is
undetermined.
We have not yet reached a decision on where the balance of the public
interest lies in respect of disclosure of the information requested. We
estimate that it will take an additional 20 days to take a decision on
where this balance lies. Therefore, we plan to let you have a response by
26/03/2020. If it appears that it will take longer than this to reach a
conclusion, you will be kept informed.
Please accept our apologies for any inconvenience that this may cause, we
will write again as soon possible.
Kind regards,
Information Rights | Information Management Department | Information
Rights Section | Essex Police
Telephone 01245 452 647 or 101 extension 150030 | Email
[1][Essex Police request email]
Address: Information Management, Information Rights, Essex Police HQ, PO
Box 2, Chelmsford CM2 6DA
[2]cid:image001.png@01D3E908.EC4D1080
Please note, if you require further information or wish to resubmit a
request please refer to the information found on the Commissioner’s
website regarding submission of effective requests
[3]https://www.ico.org.uk/for_the_public/of...
Your right to complain
If you feel your request has not been properly handled, or you are
otherwise dissatisfied with the outcome of your request you have the right
to complain.
Complaints should be submitted within 20 working days from the date of
this response and should be addressed to the Senior Information Officer at
the above address or by email to: [4][Essex Police request email]
We will conduct a review to investigate your complaint and endeavour to
reply within 20 working days.
Please explain which aspect of the reply you are not satisfied with, and
if your complaint concerns the decision to apply an exemption it would
assist the review if you would outline why you believe the exemption does
not apply.
If you are still dissatisfied following our review, you have the right
under Section 50 of the Act to complain directly to the Information
Commissioner. Before considering your complaint, the Information
Commissioner would normally expect you to have exhausted the complaints
procedures provided by Essex Police
The Information Commissioner can be contacted at: Information
Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9
5AF or via [5]https://ico.org.uk/
From: Info Rights Freedom Essex
Sent: 30 January 2020 10:48
To: 'Abdul Hai' <[FOI #639894 email]>
Subject: FOI 14153 - Use Of Cloud Analytics & Extraction
Thank you for your enquiry which has been logged under the above
reference.
Under the Freedom of Information Act we are required to reply within 20
working days. The Act does not specify a limit to the number of
information requests a public authority may receive or the number of
requests or questions an applicant may submit. However, there are
exemptions in the Act that can apply and these include where the cost of
complying with the request would extend beyond the reasonable cost limit,
(currently 18 hours or £450), or if the request is otherwise manifestly
unreasonable in its scope or nature.
Requests that ask a great many questions, or a number of detailed requests
submitted at the same time, may make it necessary for Essex Police to
refuse the requests wholly or in part. The exemption at s14 may be
engaged if the burden on the authority is increased through multiple
requests on differing subjects
The Information Commissioner’s Office (ICO) has responsibility for
providing oversight and guidance for the legislation and they have
produced advice for applicants on submitting effective requests. Further
information can be found on the Commissioner’s website at
[6]www.ico.gov.uk specific information relating to submitting a request
can be found at:
[7]https://ico.org.uk/for-the-public/offici...
While we process your request, please take the time to consider the ICO’s
advice and whether you feel it may be beneficial to amend or refine your
request. Our team is happy to discuss your request with you and will be
able to provide advice as to what kind of information will be available
from Essex Police.
Kind regards,
Information Rights Team
Information Management Department
Information Rights Section
E-Mail: [8][Essex Police request email]
[9]cid:image001.png@01D3E908.EC4D1080
Please note, if you require further information or wish to resubmit a
request please refer to the information found on the Commissioner’s
website regarding submission of effective requests
[10]https://www.ico.org.uk/for_the_public/of...
Your right to complain
If you feel your request has not been properly handled, or you are
otherwise dissatisfied with the outcome of your request you have the right
to complain.
Complaints should be submitted within 20 working days from the date of
this response and should be addressed to the Senior Information Officer at
the above address or by email to: [11][Essex Police request email]
We will conduct a review to investigate your complaint and endeavour to
reply within 20 working days.
Please explain which aspect of the reply you are not satisfied with, and
if your complaint concerns the decision to apply an exemption it would
assist the review if you would outline why you believe the exemption does
not apply.
If you are still dissatisfied following our review, you have the right
under Section 50 of the Act to complain directly to the Information
Commissioner. Before considering your complaint, the Information
Commissioner would normally expect you to have exhausted the complaints
procedures provided by Essex Police
The Information Commissioner can be contacted at: Information
Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9
5AF or via [12]https://ico.org.uk/
Thank you for your enquiry which has been logged under the above
reference.
Section 1 of the Freedom of Information Act 2000 (FOIA) places two duties
on public authorities. Unless exemptions apply, the first duty at Section
1(1)(a) is to confirm or deny whether the information specified in a
request is held. The second duty at Section 1(1)(b) is to disclose
information that has been confirmed as being held. Where exemptions are
relied upon Section 17 of FOIA requires that we provide the applicant with
a notice which: a) states that fact b) specifies the exemption(s) in
question and c) states (if that would not otherwise be apparent) why the
exemption applies.
In respect of your enquiry:
1. Do you use mobile phone extraction technology that includes cloud
analytics / cloud extraction capabilities e.g. Cellebrite UFED Cloud
Analyser, Magnet Axiom Cloud or Oxygen Forensics Cloud Extractor
2. Do you have other technologies that allow you to access cloud-based
accounts and extract this data.
3. Please provide a copy of the relevant Data Protection Impact
Assessment.
4. Please provide a copy of the relevant local and/or national
guidance/standard operating procedure/policy.
5. Please confirm the legal basis you rely on to conduct cloud
analytics/extraction.
Essex Police neither confirms nor denies that it holds information as the
duty in Section 1(1) (a) of the Freedom of Information Act 2000 does not
apply, by virtue of the following exemptions:
· Section 31 Law Enforcement and
· Section 24 National Security.
Harm in confirming information is held:
Modern day policing is intelligence led and law enforcement depends upon
the development of intelligence and the gathering and security of evidence
in order to disrupt criminal behaviour and bring offenders to justice. As
criminals adapt and exploit new technology, the police need to respond by
overcoming hi-tech barriers in order to meet their responsibilities. In
this case the information relates to the extraction of data from
individuals’ mobile devices, albeit victim or offender. By revealing
whether information is held in relation to the specific technology, will
in itself be revealing tactical information which would undermine the
process of preventing or detecting crime and the apprehension of
prosecution of offenders.
Factors favouring confirming or denial – S31
Confirming or denying that Essex Police holds information would raise the
general public’s awareness around techniques used to extract information
from mobile phones and show responsibility to delivery of effective
operational law enforcement.
Factors against confirming or denying – S31
By confirming or denying whether information is held could compromise
Essex Police law enforcement capabilities and the effectiveness of the
force will be reduced. To confirm or deny if information is held could
undermine current and/or future strategies when carrying out
investigations and gathering evidence may be compromised.
The personal safety of individuals is of paramount importance to the
Police Service and must be considered in response of every release. A
disclosure under Freedom of Information is a release to the world and, in
this case, confirming or denying if the information is held in relation to
gathering evidence from mobile phones, would undermine the evidence
gathering process of any investigative inquiry relating to offences, some
of which may be serious cases such as murder or rape.
Factors favouring confirming or denial – S24
Confirming or denial that any information exists relevant to the request
would lead to a better informed public and the public are entitled to know
how public funds are spent. The information simply relates to national
security and disclosure would not actually harm it.
Factors against confirming or denial - S24
To confirm or deny whether Essex Police hold any information would allow
inferences to be made about the nature and extent of national security
related activities which may or may not take place. This could enable
terrorist groups to take steps to avoid detection, and as such,
confirmation or denial would be damaging to national security.
By confirming or denying any policing arrangements of this nature would
render national security measures less effective. This would lead to the
compromise of ongoing or future operations to protect the security or
infra-structure on the UK and increase the risk of harm to the public.
Balancing Test
As always the Freedom of Information Act has a presumption of disclosure,
unless when balancing the competing public interest factors the prejudice
to the community outweighs the benefits. In this case, there is an
argument for confirming or denying, inasmuch as the public have a right to
know that every effort is made to gather all relevant evidence, including
extracting data from mobile phones, but this must be balanced against the
negative impact these disclosures can make.
Law Enforcement is reliant on community engagement, intelligence and
evidence gathering and when it is appropriate, information is given to the
public. What has been established in this case is the fact that confirming
or denying that information relating to technologies used when extracting
data would be harmful and have an adverse effect on the investigative
process and on the public prevention or detection of crime and the
apprehension or prosecution of offenders. This places the victims of such
offending at a greater risk towards their health and wellbeing and is not
an action the Police Service would be willing to take. These negatives
outweigh any tangible community benefit and therefore the balance does not
favour disclosure at this time.
No inference can be drawn from this refusal that information is or isn’t
held.
Thank you for your interest in Essex Police.
Kind regards
Information Rights | Information Management Department | Information
Rights Section | Essex Police
Telephone 01245 452 647 or 101 extension 150030 | Email
[1][Essex Police request email]
Address: Information Management, Information Rights, Essex Police HQ, PO
Box 2, Chelmsford CM2 6DA
[2]cid:image001.png@01D3E908.EC4D1080
Please note, if you require further information or wish to resubmit a
request please refer to the information found on the Commissioner’s
website regarding submission of effective requests
[3]https://www.ico.org.uk/for_the_public/of...
Your right to complain
If you feel your request has not been properly handled, or you are
otherwise dissatisfied with the outcome of your request you have the right
to complain.
Complaints should be submitted within 20 working days from the date of
this response and should be addressed to the Senior Information Officer at
the above address or by email to: [4][Essex Police request email]
We will conduct a review to investigate your complaint and endeavour to
reply within 20 working days.
Please explain which aspect of the reply you are not satisfied with, and
if your complaint concerns the decision to apply an exemption it would
assist the review if you would outline why you believe the exemption does
not apply.
If you are still dissatisfied following our review, you have the right
under Section 50 of the Act to complain directly to the Information
Commissioner. Before considering your complaint, the Information
Commissioner would normally expect you to have exhausted the complaints
procedures provided by Essex Police
The Information Commissioner can be contacted at: Information
Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9
5AF or via [5]https://ico.org.uk/
From: Info Rights Freedom Essex
Sent: 30 January 2020 10:48
To: 'Abdul Hai' <[FOI #639894 email]>
Subject: FOI 14153 - Use Of Cloud Analytics & Extraction
Thank you for your enquiry which has been logged under the above
reference.
Under the Freedom of Information Act we are required to reply within 20
working days. The Act does not specify a limit to the number of
information requests a public authority may receive or the number of
requests or questions an applicant may submit. However, there are
exemptions in the Act that can apply and these include where the cost of
complying with the request would extend beyond the reasonable cost limit,
(currently 18 hours or £450), or if the request is otherwise manifestly
unreasonable in its scope or nature.
Requests that ask a great many questions, or a number of detailed requests
submitted at the same time, may make it necessary for Essex Police to
refuse the requests wholly or in part. The exemption at s14 may be
engaged if the burden on the authority is increased through multiple
requests on differing subjects
The Information Commissioner’s Office (ICO) has responsibility for
providing oversight and guidance for the legislation and they have
produced advice for applicants on submitting effective requests. Further
information can be found on the Commissioner’s website at
[6]www.ico.gov.uk specific information relating to submitting a request
can be found at:
[7]https://ico.org.uk/for-the-public/offici...
While we process your request, please take the time to consider the ICO’s
advice and whether you feel it may be beneficial to amend or refine your
request. Our team is happy to discuss your request with you and will be
able to provide advice as to what kind of information will be available
from Essex Police.
Kind regards,
Information Rights Team
Information Management Department
Information Rights Section
E-Mail: [8][Essex Police request email]
[9]cid:image001.png@01D3E908.EC4D1080
Please note, if you require further information or wish to resubmit a
request please refer to the information found on the Commissioner’s
website regarding submission of effective requests
[10]https://www.ico.org.uk/for_the_public/of...
Your right to complain
If you feel your request has not been properly handled, or you are
otherwise dissatisfied with the outcome of your request you have the right
to complain.
Complaints should be submitted within 20 working days from the date of
this response and should be addressed to the Senior Information Officer at
the above address or by email to: [11][Essex Police request email]
We will conduct a review to investigate your complaint and endeavour to
reply within 20 working days.
Please explain which aspect of the reply you are not satisfied with, and
if your complaint concerns the decision to apply an exemption it would
assist the review if you would outline why you believe the exemption does
not apply.
If you are still dissatisfied following our review, you have the right
under Section 50 of the Act to complain directly to the Information
Commissioner. Before considering your complaint, the Information
Commissioner would normally expect you to have exhausted the complaints
procedures provided by Essex Police
The Information Commissioner can be contacted at: Information
Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9
5AF or via [12]https://ico.org.uk/
We work to defend the right to FOI for everyone
Help us protect your right to hold public authorities to account. Donate and support our work.
Donate Now