Question
Following recent reports that technology supplied by the Israeli company Cellebrite was used on a phone by the journalist Barry McCaffrey in September 2018 – can PSNI confirm what contract, agreement or other arrangements it has (or had) for using the technology supplied by the company and for what purpose it is used.
Further, could PSNI outline how often the technology has been used against journalists, lawyers, NGOs, its own police officers and staff and others since 2011 and whether the use of this technology will form part of the review being conducted by Angus McCullough?
Answer
The Police Service of Northern Ireland use powers granted under Police and Criminal Evidence (NI) Order 1989 and Part 2, Chapter 3 of Police, Crime, Sentencing and Courts Act 2022 in order to carry out lawful extractions of data from digital devices.
Police Service of Northern Ireland have fully implemented the recommendations outlined in the Information Commissioner’s Office (ICO) report into Mobile Phone Data Extraction by Police in Northern Ireland (June 2021), resulting in a robust authorisation procedure for extraction of not only mobile phones but all digital devices.
If an investigating officer believes their investigation would be enhanced by the extraction of a person’s device, they are required to do the following:
- Complete a Digital Processing Notice (DPN) outlining reasonable lines of enquiry, the basis for their belief that examination of the device(s) will result in relevant material, how the application meets the necessity test and how they plan to mitigate collateral intrusion.
The DPN form is reviewed by the Inspector or above in charge of the investigation
3. The investigating officer then submits an application to C1 Cyber, outlining the requirements, attaching a form confirming their compliance with the DPN process.
4. C1 Cyber supervision review the application and accept it for examination, if it meets the standard outlined by the ICO recommendations.
5. Cyber examiners review the case and record their method of extraction to meet the requirements of the DPN form in the Cyber case management system.
6. Cyber supervisors review the entry by Cyber examiners and authorise them to continue.
This process is used in all cases, including those submitted by the Police Service’s Professional Standards Department. Police Service of Northern Ireland Cyber do not routinely extract devices on behalf of the Police Ombudsman for Northern Ireland.
In relation to the Cellebrite company, Cellebrite is a Software provider to Law Enforcement Agencies World-Wide to support the digital extraction of evidential material from Digital Devices.
With regards to part of the question re how often the technology is used in relation to the groups of people mentioned, an independent review is being undertaken by Angus McCullough KC, who states on the independent review website that:
He has been appointed to conduct an independent review of any PSNI use of surveillance against certain groups: journalists, lawyers, NGO’s, and regulators (Police Ombudsman for Northern Ireland and the Northern Ireland Policing Board) from 2011 to 1 November 2024.
It would therefore be inappropriate to answer this question at the current time since it is the crux of the independent review.
Les Allamby