Digital Forensic Examinations 628/2023
FOI Reference: 628/2023
Request 1 - 6:
- The number of digital forensic examinations carried out by in-house, police forensic services in the past 12 months or similar reporting period
- The number of digital forensic examinations carried by outside laboratories and/or outside forensic science services in the same period
- The names of any digital forensic laboratories and/or outside forensic science services used
- The current backlog of digital forensic examinations
- The number of Forensic Science Activities, in accordance with the Forensic Science Regulator Act 2021, that you are / are not currently accredited to deliver
- The number of Forensic Science Activities completed in laboratories which are not accredited to ISO 17025
Response 1:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
A total of 1,561 digital forensic examinations were carried out by in-house police forensic services in the past 12 months.
Response 2:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
A total of 40 digital examinations were carried out by outside laboratories and/or outside forensic science services in the same period.
Response 3:
I can confirm that Dyfed-Powys Police does hold the information requested however a Section 31(1)(a)(b) Law Enforcement exemption has been applied to some of the requested information thereby exempting its release.
Section 1 of the Freedom of Information Act 2000 places two duties on public authorities. Unless exemptions apply, the first duty at Section 1(1) (a) is to confirm or deny whether the information specified in a request is held. The second duty at Section 1(1) (b) is to disclose information that has been confirmed as being held.
Where exemptions are relied upon section 17 of FOIA requires that we provide the applicant with a notice which:
a) States that fact
b) Specifies the exemption(s) in question and
c) State (if that would not otherwise be apparent) why the exemption applies
Section 31(1)(a)(b) Law Enforcement:
(1) Information which is not exempt information by virtue of section 30 is exempt information if its disclosure under this Act would, or would be likely to prejudice -
(a) the prevention or detection of crime
(b) the apprehension or prosecution of offenders
Section 31 is a prejudice based qualified exemption and as such, there is a requirement to provide details of the harm as well as the public interest test.
Section 31 Evidence of Harm
Under the Act, we cannot, and do not request the motives of any application for information. We have no doubt that the vast majority of requests made under the Act are legitimate and the applicants do not have any ulterior motives. However, in disclosing information to one applicant, we are expressing a willingness to provide it to anyone in the world. This means that a disclosure to a genuinely interested and concerned person automatically opens it up for a similar disclosure, including those who would use the information to gain an advantage over our ability to exercise our core function, which is Law Enforcement.
In considering whether or not this information should be disclosed, consideration has been given to the potential harm that could be caused by disclosure.
The Harm Test process requires Dyfed-Powys Police to consider any possible harm that might arise as a result of placing the requested information into the public domain. This process considers the potential harm to:
- Individuals
- The community as a whole
- Dyfed-Powys Police and the wider policing service
- Other bodies
Policing is an information-led activity, and information assurance (which includes information security) is fundamental to how the Police Service manages the challenges faced. In order to comply with statutory requirements, the College of Policing Authorised Professional Practice for Information Assurance has been put in place to ensure the delivery of core operational policing by providing appropriate and consistent protection for the information assets of member organisations, see below link:
https://www.app.college.police.uk/app-content/information-management/
Commercial Forensic Service Providers are vitally important in the Criminal Justice system - not only do they play a crucial role by supporting UK Policing with backlogs in the Digital Forensics arena, but they provide Defence teams with access to independent forensic experts to support their clients.
Whilst not in any way questioning the motives of the applicant, it must be taken into account when considering potential harm that a disclosure under the Freedom of Information Act 2000 is made to the world at large, rather than a private correspondence. Specific details of any forensic service providers used by Dyfed-Powys Police would be extremely useful to those involved in criminality as it would enable them to create a map of those most used by police Forces. Forensic Service Providers can be targeted by malicious actors, for example in 2019 Eurofins (one of the UKs largest FSPs) suffered a highly sophisticated ransomware attack which severely disrupted UK Policing and the Criminal Justice system.
https://www.helpnetsecurity.com/2019/06/24/eurofins-ransomware-attack/
By providing a list of forensic service providers, Force by Force, a malign individual could identify those most critical to the Law-and-Order sector and specifically target those proving the most assistance. This would have a huge impact on the effective delivery of operational law enforcement as it would leave companies open to further cyberattacks which could have devastating consequences for law enforcement.
Factors favouring Disclosure - Confirming the names of Forensic Service Providers would be of interest to the public, namely give insight into the forensic processes used to solve crimes.
Factors favouring Non-Disclosure - Measures are put in place to protect the community we serve and as evidenced within the harm, to provide a detailed list of Forensic Service Providers would allow individuals intent on disrupting law enforcement to target specific companies using the information obtained to maximise the impact.
Taking into account the current security climate within the United Kingdom, and the recent Eurofins cyber-attack, no information which may aid criminality should be disclosed. It is clear that it would have an impact on a Force’s ability to carry out the core duty of enforcing the law and serving the community.
The public entrust the Police Service to make appropriate decisions with regard to their safety and protection and the only way of reducing risk is to be cautious with what is placed into the public domain.
Balance Test - The Police Service is charged with enforcing the law, preventing and detecting crime and protecting the communities we serve. In order to effectively and robustly carry out those duties, external services are utilised which are vital to investigating criminal activity.
Weakening the mechanisms used to investigate any type of criminal activity would have a detrimental impact on law enforcement as a whole. To provide the names of the FSPs despite the known risks of cyber-attacks would undermine any trust or confidence the public have in the Police Service. Therefore, at this moment in time, it is our opinion that the balance test favours against the disclosure of the FSP used for digital forensics.
Response 4:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
69 devices.
Response 5:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
We have capture, processing, and analysis for computers.
We have Capture and processing for mobiles.
We do not have analysis for mobiles.
We do not have screening or capture/preservation of cloud storage in either remit.
Response 6:
I can confirm that Dyfed-Powys Police does hold the information requested, as outlined below.
There are a total of zero Forensic Science Activities completed in laboratories which are not accredited to ISO 17025.
It should be noted that as a result of the systems adopted by Dyfed-Powys Police in relation to the recording of such information that the information released may or may not be accurate.
(This is a response under the Freedom of Information Act 2000 and disclosed on 16/07/2024)