Digital forensic roles 84/24
FOI Reference: 84/2024
Request 1 - 14:
1. Please provide the role title, department title and total number (count) of all roles dedicated to digital forensic activities within your organisation?
2. How many digital devices were submitted to departments who’s main function is digital forensic activity over the past 12 months? In your response, please provide the name of the department(s) alongside the total number.
3. Of the submitted devices listed in your above response:
a. how many are submitted as mobile phone or tablet type devices?
b. how many are submitted as computer or laptop type devices?
c. how many are submitted as separate data storage devices, such as HDD, USB, memory card?
In your response please only include submitted devices and do not include associated sub-exhibits found within a submitted device during Forensic Science Activity.
4. How many digital device examinations are completed by departments who’s main function is digital forensic activity each month for the past 12 months?
In your response please only include submitted devices and do not include associated sub-exhibits found within a submitted device during Forensic Science Activity
5. How many digital devices are currently awaiting examination in your main digital forensic unit(s)? In your response please provide the date that the data was generated.
6. How many digital devices were awaiting examination in your main digital forensic unit(s) 3 months prior to the date provided in question 5?
7. How many digital devices were awaiting examination in your main digital forensic unit(s) 6 months prior to the date provided in question 5?
8. Where present within your organisation, how many digital devices are submitted to ‘frontline’ digital forensic capability such as mobile ‘kiosk’ over the past 12 months?
9. Where present within your organisation, how many digital devices examinations are completed by frontline digital forensic capability such as mobile ‘kiosk’ over the past 12 months?
10. Over the past 12 months, how many digital devices have been sent to an external contractor for digital forensic activities by your organisation?
11. Do you have a contract in place with an external digital forensic provider for the provision of digital forensic services?
12. If you have answered ‘yes’ to the previous question, please provide the following details:
a. The name of all external digital forensic providers you contract with.
b. The start and end date of the contract.
c.The contracting mechanisms you used.
13. Do you hold accreditation to ISO/IEC 17025, FSR Codes and ILAC G19 for digital forensic activities?
14. Are you intending to undertake any extensions to scope of you accreditation within the next 12 months? If so, please provide details of proposed scope?
Response:
I can confirm that Dyfed-Powys Police does hold the information requested, however a Section 31(1)(a)(b) Law Enforcement exemption has been applied to part of the requested information thereby exempting its release.
Section 1 of the Freedom of Information Act 2000 places two duties on public authorities. Unless exemptions apply, the first duty at Section 1(1) (a) is to confirm or deny whether the information specified in a request is held. The second duty at Section 1(1) (b) is to disclose information that has been confirmed as being held.
Where exemptions are relied upon section 17 of FOIA requires that we provide the applicant with a notice which:
a) States that fact
b) Specifies the exemption(s) in question and
c) State (if that would not otherwise be apparent) why the exemption applies
Section 31(1)(a)(b) Law Enforcement:
- Information which is not exempt information by virtue of section 30 is exempt information if its disclosure under this Act would, or would be likely to prejudice -
- the prevention or detection of crime
- the apprehension or prosecution of offenders
Section 31 is a prejudice based qualified exemption and as such there is a requirement to provide details of the harm as well as the public interest test.
Harm in Disclosure
The Harm Test process requires Dyfed-Powys Police to consider any possible harm that might arise as a result of placing the requested information into the public domain. This process considers the potential harm to:
- Individuals
- The community as a whole
- Dyfed-Powys Police and the wider policing service
- Other bodies
Policing is an information-led activity, and information assurance (which includes information security) is fundamental to how the Police Service manages the challenges faced. In order to comply with statutory requirements, the College of Policing Authorised Professional Practice for Information Assurance has been put in place to ensure the delivery of core operational policing by providing appropriate and consistent protection for the information assets of member organisations, see below link: https://www.app.college.police.uk/app-content/information-management/
Commercial Forensic Service Providers are vitally important in the Criminal Justice system - not only do they play a crucial role by supporting UK Policing with backlogs in the Digital Forensics arena, but they provide Defence teams with access to independent forensic experts to support their clients.
Whilst not in any way questioning the motives of the applicant, it must be taken into account when considering potential harm that a disclosure under the Freedom of Information Act 2000 is made to the world at large, rather than a private correspondence. Specific details of any forensic service providers used by Dyfed-Powys Police would be extremely useful to those involved in criminality as it would enable them to create a map of those most used by police Forces. Forensic Service Providers can be targeted by malicious actors, for example in 2019 Eurofins (one of the UKs largest FSPs) suffered a highly sophisticated ransomware attack which severely disrupted UK Policing and the Criminal Justice system.
https://www.helpnetsecurity.com/2019/06/24/eurofins-ransomware-attack/
By providing a list of forensic service providers, Force by Force, a malign individual could identify those most critical to the Law-and-Order sector and specifically target those proving the most assistance. This would have a huge impact on the effective delivery of operational law enforcement as it would leave companies open to further cyberattacks which could have devastating consequences for law enforcement.
Factors favouring Disclosure - Confirming the names of Forensic Service Providers would be of interest to the public, namely give insight into the forensic processes used to solve crimes.
Factors favouring Non-Disclosure - Measures are put in place to protect the community we serve and as evidenced within the harm, to provide a detailed list of Forensic Service Providers would allow individuals intent on disrupting law enforcement to target specific companies using the information obtained to maximise the impact.
Taking into account the current security climate within the United Kingdom, and the recent Eurofins cyber-attack, no information which may aid criminality should be disclosed. It is clear that it would have an impact on a Force’s ability to carry out the core duty of enforcing the law and serving the community.
The public entrust the Police Service to make appropriate decisions with regard to their safety and protection and the only way of reducing risk is to be cautious with what is placed into the public domain.
Balance Test - The Police Service is charged with enforcing the law, preventing and detecting crime and protecting the communities we serve. In order to effectively and robustly carry out those duties, external services are utilised which are vital to investigating criminal activity. Weakening the mechanisms used to investigate any type of criminal activity would have a detrimental impact on law enforcement as a whole. To provide the names of the FSPs despite the known risks of cyber-attacks would undermine any trust or confidence the public have in the Police Service. Therefore, at this moment in time, it is our opinion that the balance test favours against the disclosure of the FSP used for digital forensics.
Response 1:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
Role title:
Digital Forensic Technician
Digital Forensic Investigator
Senior Manager - Digital Forensics
Technical Specialist - Digital Devices
Analyst - Digital Investigation Unit
ICT Specialist (Digital Forensic Unit)
Department title:
Forensic Services
Total number (count) of all roles dedicated to digital forensic activities within your organisation:
21
Response 2:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
Digital Forensic Unit
1465
Response 3:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
a. Mobile / tablet devices: 1065
b. Computer devices 211
c. 189
Response 4:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
1898
Response 5:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
103 – 07/01/24
Response 6:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
124 – 05/12/23
Response 7:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
225 – 09/07/23
Response 8:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
None
Response 9:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
None
Response 10:
Section 31 exemption applied
Response 11:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
Yes
Response 12:
Section 31 exemption applied
Response 13:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
Yes
Response 14:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
Yes
Mobile phones – analysis
It should be noted that as a result of the systems adopted by Dyfed-Powys Police in relation to the recording of such information that the information released may or may not be accurate.
(This is a response under the Freedom of Information Act 2000 and disclosed on 29/02/2024)