Neutral Citation Number: [2022] UKIP Trib 7
Case No: IPT/20/02/C
IN THE INVESTIGATORY POWERS TRIBUNAL
Date: 30 December 2022
Before :
LORD JUSTICE EDIS
PROFESSOR GRAHAM ZELLICK CBE KC and
MR DESMOND BROWNE CBE KC
– – – – – – – – – – – – – – – – – – – – –
Between :
KJF Appellant
– and –
SURREY POLICE Respondent
– – – – – – – – – – – – – – – – – – – – –
– – – – – – – – – – – – – – – – – – – – –
Ms Rosemary Davidson (Counsel to the Tribunal)
[written submissions only]
JUDGMENT
This is the judgment of the Tribunal:
1. This complaint raises an interesting and important point: may the police break into a mobile phone which has been lawfully seized under a search warrant issued under s. 8 of the Police & Criminal Evidence Act 1984 (“PACE”)? The Complainant argues that the police, although in lawful possession of the phone pursuant to the warrant, must nevertheless obtain an authorisation under the Regulation of Investigatory Powers Act 2000 (“RIPA”) or the Investigatory Powers Act 2016 (“IPA”). If they fail to obtain such authorisation, they will not only have acted unlawfully but may even expose themselves to criminal liability under the Computer Misuse Act 1990 or the Investigatory Powers Act 2016 (“IPA”). The Respondents say that the warrant under PACE empowers them to break into the phone, either because of PACE itself or PACE in conjunction with the IPA, which has amended RIPA. If the action of the police is justified under PACE, this Tribunal has no jurisdiction and the complaint must be dismissed.
2. Although there has been no public hearing in this case, we have had the benefit of written submissions from Ms Rosemary Davidson, who was appointed as Counsel to the Tribunal (CTT), and we have considered this complaint in the light of our consideration of Hill v. IOPC and MPS, the judgment in which is being handed down at the same time as this judgment. In Hill, we heard from counsel for the parties as well as the Home Secretary and also Ms Davidson as CTT. Reference will be made below to our judgment in Hill and this judgment should be read in the light of Hill.
3. The Tribunal acknowledges that as a suspect in criminal proceedings, the Complainant’s legitimate expectation of privacy under Art. 8 of the European Convention on Human Rights is engaged. As there was no public hearing in this case and the Complainant was not charged with any criminal offence, the Tribunal has decided that it would be right to anonymise him for the purposes of this judgment. He is referred to as “KJF”.
4. The essential facts are not in dispute. The Professional Standards Department of Surrey Police were carrying out an investigation into the possible theft of funds raised for a charity. The fund-raiser was KJF’s partner, a civilian employee of Surrey Police, who apparently was unable to provide receipts from the charity for the funds raised; and the charity is said to have confirmed that no monies had been received. She lived with KJF, an officer in the same police force.
5. A search warrant issued by a magistrate under PACE was executed on 20 November 2019 at the home of KJF and his partner and KJF’s mobile phone was seized. The application for the warrant referred specifically to mobile phones and other electronic devices which might provide evidence of correspondence between the parties involved, which in turn might support or disprove the explanations provided by KJF’s partner. KJF was named in the application for the warrant and was regarded as a suspect.
6. KJF was asked a number of times for the PIN, both informally and more formally on 17 December 2019 when interviewed under caution, but he refused to reveal it. At no time was he served with a notice under s. 49 of RIPA requiring him to disclose the PIN, as the Chief Inspector who was the Appropriate Authority did not consider it proportionate given the nature of the offence being investigated.
7. A notice under s. 49 of RIPA may be served in circumstances such as these, subject to various criteria such as proportionality (s. 49(2)(c)). It requires the person on whom it is served to disclose the “key” – in this case the PIN. Failure to comply with such a notice is a criminal offence punishable under s. 53 (in a case such as this) by up to two years’ imprisonment and a fine if convicted on indictment or six months’ imprisonment and a fine on summary conviction.
8. There is no inconsistency in not serving a s. 49 notice yet proceeding to access (or attempt to access) the phone’s contents. If the statutory grounds for issuing a notice were not satisfied, as the Chief Inspector believed, then it would have been unlawful to serve one. That, however, does not mean that he necessarily thought it would be wrong or unlawful to seek access to the phone by other means.
9. At the time of submitting his complaint to the Tribunal on 6 January 2020, the phone was still retained by the police. It was eventually returned to him on 17 March 2020. KJF was aware that the police’s Digital Forensics Team had first attempted to obtain the phone’s data; when that failed, it was outsourced, first to one company (which also failed) and then another. At the time of making his complaint, KJF believed that this third company would succeed, or had succeeded, in accessing his data.
10. At all stages KJF denied any involvement in the fund-raising or in any theft of funds. He was never charged with an offence or subject to disciplinary proceedings in respect of the charitable funds, although he was given a final written warning in disciplinary proceedings based on other evidence arising out of the search. He remains an officer in Surrey Police. KJF’s partner was dismissed for gross misconduct in relation to the missing funds.
11. Efforts to secure access to the phone’s data were in fact eventually abandoned and so no information from it was ever obtained. We shall return later to the legal significance of this.
12. Neither the lawfulness of the warrant nor the search and seizure carried out under it has been questioned.
13. Surrey Police point to the width of the power of seizure in s. 8(1) of PACE, citing R. (Faisaltex Ltd) v. Preston Crown Court [2008] EWHC 2832 (Admin) in support of the proposition that a computer or disk might be seized even if it also contained material that was irrelevant.
14. The Respondents then cite R. (Cabot Global Ltd) v. Barkingside Magistrates’ Court [2015] EWHC 1458 (Admin) in support of the proposition that such material may be removed from the search premises for subsequent analysis.
15. The Respondents state that KJF’s refusal to disclose his PIN gave rise to a reasonable inference that his phone contained incriminating evidence. That may or may not be so, but it cannot provide a basis for the action that followed unless that action is sanctioned by law.
16. Surrey Police say that the PACE warrant makes breaking into the phone lawful.
17. The police often remove large quantities of documents which it would be impractical to scrutinise at the premises; or a locked safe, strong box or filing cabinet which can then more conveniently be opened at the police station (see further the Criminal Justice & Police Act 2001, s. 50). But the question here is whether this proposition extends to electronic information that might otherwise fall within the ambit of RIPA/IPA. In other words, is further authorisation under RIPA’s or IPA’s more stringent safeguards required, as the Complainant submits?
18. Our conclusion is that the PACE power authorises the downloading of the phone, and therefore we have no jurisdiction, but the legal reasoning differs according to the precise circumstances in which the downloading takes place.
19. There are two possibilities: either the mobile phone is interrogated while it is still connected to the telecommunications system or, as will more usually be the case, it is disconnected from the system, the SIM card is removed and the device is placed in a “Faraday environment” (i.e. blocking any electro-magnetic field).
20. In the latter situation, the data stored on the phone is not “stored in or by a telecommunication system” (IPA, s. 6(1)(c)). Any provisions in RIPA/IPA do not, therefore, apply and it is a straightforward situation of applying the powers in PACE, whether under a search warrant (s. 8) or following arrest (ss. 18 and 32). This is the Tribunal’s decision in Hill where the full and rather complicated analysis will be found.
21. Where the seizure of the device has taken place under PACE – even if it subsequently transpires that it was not lawful, provided it was a bona fide exercise of the relevant power – the Tribunal has no jurisdiction: Hill v. IOPC. It is a matter for the ordinary courts. This Tribunal has no jurisdiction in respect of PACE powers.
22. PACE permits the interrogation of a disconnected mobile phone in precisely the same way that it permits the seizure and removal of a locked safe or filing cabinet, the contents to be examined later at the police station once it has been opened and its contents removed.
23. Different statutory provisions apply where the mobile phone remains connected to the telecommunications system, because the interrogation of the device then constitutes interception, owing to the extended definition of “interception” in the IPA, but it is rendered lawful without further authority by virtue of s. 6(1)(c)(ii) of IPA: it “is in the exercise of any statutory power that is exercised for the purpose of obtaining information or taking possession of any document or other property”. Again, the full reasoning may be found in Hill.
24. These conclusions are consistent with the Code of Practice on Interception of Communications issued by the Home Office in March 2018 pursuant to Schedule 7 to the IPA. Para. 12.14 of the Code states that there are a number of statutes used for the purpose of obtaining stored communications for evidential purposes and lists, among those most commonly used by law enforcement agencies, “powers of search, seizure or production under [PACE]”. It is also worthy of note that the exercise of such powers is excluded from the scope of review by the Investigatory Powers Commissioner (IPA, s. 249(4)(d)(i)). It is also worth adding that, although in these circumstances there has been an interception, the material so obtained is not inadmissible in legal proceedings under s. 56 of IPA: IPA, Sched. 3, para. 2(1)(a). Issues could, of course, arise under s. 78 of PACE (exclusion of unfair evidence).
25. In short, it is inconceivable that Parliament would have legislated explicitly to permit a PACE warrant to justify the interception of material stored in or by a telecommunications system (IPA, s. 6(1)(c)(ii)) and to render that material admissible evidence (IPA, Sched. 3, para. 2(1)(a)) while at the same time implicitly denying that justification where the material was merely stored on the device itself.
26. We do not know whether KJF’s phone was connected to the system or not when it was interrogated, but either way the attempt to download its contents was justified under PACE and the Complainant’s submission is therefore incorrect.
27. Finally, we add a comment relating to the fact that the police never did secure access to the phone and retrieved no data. We did not dismiss this complaint immediately on discovering that, despite all their efforts, the respondents eventually abandoned their efforts to break into the phone without retrieving any data, since it seemed to us that, in the absence of legal authority to access and retrieve the stored information, even unsuccessful efforts to hack into the phone might be unlawful and in breach of RIPA or IPA. On one analysis, KJF had suffered no invasion of his privacy and therefore nothing unlawful had taken place. This might be a valid approach in respect of a claim under s. 7 of the Human Rights Act (which this is not), but it would not necessarily apply in a complaint such as this. We have not received submissions or heard argument on this point and it is not relevant to our decision. Accordingly, we express no opinion.
28. We conclude that the Respondents were entitled, having lawfully seized the phone under a search warrant, to take steps to recover its stored data without any further authorisation, though in the event no such data was retrieved. Accordingly, the complaint is not within our jurisdiction and it is accordingly dismissed.
29. We specify, in accordance with s. 67A(2) of RIPA, that the relevant appellate court is the Court of Appeal in England & Wales.