Justice Committee

Meeting date: Tuesday, June 28, 2016

Official Report 520KB pdf

---

HM Inspectorate of Constabulary in Scotland Assurance Review of Police Scotland’s Counter-Corruption Unit

It is now my pleasure to welcome Derek Penman, who is HM inspector of constabulary in Scotland; Stephen Whitelock, who is a lead inspector at HM inspectorate of constabulary in Scotland; and John Young, who is an associate inspector at HM inspectorate of constabulary in Scotland.

We are very grateful to the inspector of constabulary for responding to the committee’s concerns about the slippages in the reporting timetable and for producing the report for the meeting. That was very helpful, and we are very grateful to him for taking cognisance of that.

I understand that Mr Penman wants to make an opening statement.

Thank you, convener, and thank you for the opportunity to come to speak about our report on counter-corruption.

As members are aware, the report was requested by the Scottish Police Authority—that identifies its interest in the matter. I recognise the commitment from the chair and the chief constable, since our report was published, to accept and take forward all our recommendations.

I will give some background, if I may. HMIC’s role is independent, and my role is to look at the effectiveness and efficiency of policing in Scotland. My focus is very much on adding value, and my task is really to identify improvements in policing and not to apportion or identify blame. The reports are written in that spirit.

I highlight that we have had full access to all the information relative to the counter-corruption unit and in particular to the circumstances surrounding its investigation of the leak of information to journalists. As part of that, we have had access to protected information that people provided on a confidential basis. There is an understanding that that information will be kept confidential and that I will not breach any trust or confidence or identify any sources or indeed covert techniques or tools that have been applied.

My starting point on counter corruption is that Police Scotland needs an effective counter-corruption capability, which must have the same ethical standards as the rest of Police Scotland, must conduct itself in the same manner as that in which the rest of Police Scotland conducts itself, and must be subject to effective scrutiny.

I am aware of the committee’s interest in the matter. In particular, we took the opportunity in our review to look at Police Scotland’s wider investigation into the circumstances surrounding the alleged leak of information, as a case study.

A key point at the start of our evidence today is the need to keep in focus the reinvestigation of the murder of Emma Caldwell. The Sunday Mail article on 5 April raised public awareness of Emma’s murder and raised legitimate questions about the initial investigation from 2005 to 2007. That article prompted Police Scotland to review the case and the Crown Office and Procurator Fiscal Service to instruct a reinvestigation.

We took the opportunity to look into that, as part of our review. We found that the reinvestigation is well resourced, has an experienced senior investigating officer, and has no staff who were involved in the previous investigations. It is also applying a modern approach to witnesses and forensics. Importantly, there is robust governance and oversight of the inquiry, which is also provided by the Crown Office and Procurator Fiscal Service. For me, as we go into more evidence, it is important that the public and especially the family have confidence in the integrity of the reinvestigation. I hope that our report will provide that.

It is not true to say that Police Scotland put all its efforts into finding the source of a leak, to the detriment of the Emma Caldwell investigation, as some of the media speculated at the time. I think that our review has shown that Police Scotland acted quickly, undertook a review and has a robust investigation in place. It is also important to recognise that the reinvestigation is live, and it is not helpful to speculate about suspects or in a way that might compromise the proceedings.

In part 1 of the report, we did not review—or we have not commented on—the Interception of Communications Commissioner’s Office’s findings specifically in relation to the applications. IOCCO published a memo and submitted supporting documents on 17 June, which we consider to be particularly helpful, in that they place in the public domain for the first time a full account and the extent of the commissioner’s criticism. Therefore, we did not find it necessary to provide that level of detail in our report, and we relied fully on the IOCCO determination.

We are aware that Police Scotland has conceded that the communications data authorisations were obtained in contravention of the 2015 acquisition and disclosure of communications data code of practice, and that the people who are affected by that have a real remedy through the Investigatory Powers Tribunal hearing in July. Again, it is important that our report does not compromise the integrity of those proceedings.

I am conscious of the time, but I would like to take a few more minutes, if that is okay, convener.

You can do so very briefly, Mr Penman. We have a number of questions, which I am sure will give you the opportunity to elaborate on anything that you cover briefly in your opening statement.

Thank you. I just have some key points to make. Our review shows that Police Scotland was aware on 21 August that the information that was suspected to have been leaked to journalists had in fact been released some years previously to the Crown Office. Police Scotland was also aware that there was no live inquiry at the time of the Sunday Mail article. Our report highlights that it might have been useful to have clarified that when Police Scotland gave evidence to the Justice Committee.

We also found that Police Scotland was prepared for the code and that the organisation had not failed in promulgating that information; the designated person in this case had actually asked for advice, which had been given. We found no evidence of any undue pressure or coercion on the designated person or anyone else to undermine the code. Nor did we find evidence of any chief officer involvement.

Our conclusion was that all lines of inquiry were not fully exhausted by the CCU intelligence section. We believe that the review lacked objectivity and that the application for communications data was made too early in the process.

I note that we expected you to make a two-minute opening statement. You have now given almost a five-minute statement. Just for the record, when we get opening statements in future from witnesses, we will expect them to keep to the very brief timescale.

I will now take questions. I am inclined not to start with Stewart Stevenson, because he indicated when Mr Penman was speaking and he really should have been listening, but I will let you off this time, Mr Stevenson.

If I may say so, that is entirely out of order, because I wanted to indicate a desire to ask a question specifically on the statement that was made.

Right. I misunderstood. Is there anything else that you want to say now?

If you will allow me, I will ask a very brief question that I suggest requires only a very brief answer.

Okay.

It is about the general role of the inspector. Mr Penman, you said that effectiveness and efficiency are the key things that you are looking at. You then said that you want the same ethical standards as apply in the rest of the police force to apply to the CCU. I understand all that, but is the examination of ethical standards something that you normally incorporate into all the investigations and work that you do across the police force? It is as simple as that.

The short answer is yes, in as much as we consider in our inquiries whether the values in particular of Police Scotland around integrity, fairness and respect are evidenced by the leadership.

Thank you.

Good morning, Mr Penman. Thank you for your report and your on-going detailed work. The Justice Committee heard on 15 December from the then deputy chief constable, Neil Richardson. Mr Richardson lied to the committee. Is that correct?

I do not think that he lied to the committee. In my report, I said that with regard to the evidence that he gave in relation to whether the inquiry was live, the initial assessment had been provided to him by the CCU. That was the evidence that he provided, and it was accurate at that time. The observation that I made in my report was that at the time when the evidence was given Police Scotland would have been in a position to have known that the inquiry was not live and that the information that had been reported in the Sunday Mail had actually been provided by the Crown to others some years before.

So Mr Richardson gave the committee erroneous information.

My view is that there would have been an opportunity for Police Scotland to have given a better account of that evidence, which would have been helpful to the public’s understanding of the matter and would have explained to those who had read the Sunday Mail what the source of the information might have been.

With regard to its internal focus, the counter-corruption unit’s remit mentions reducing

“the risk of compromise of ongoing operational activity”—

and the answer that we are discussing related to what should have been on-going operational activity—as well as reducing

“the risk presented by individual officers ... or members of staff”

and increasing “public confidence”. Do you imagine that what we heard from Mr Richardson would have triggered an inquiry by the counter-corruption unit?

As we highlighted in the report—and taking into account the circumstances as they have been assessed by the CCU—if information from a live murder inquiry that was sensitive and that might compromise the integrity of an on-going prosecution was leaked, it would, under those circumstances, be appropriate for the counter-corruption unit to investigate that.

For the avoidance of doubt, I am specifically saying that the conduct of Mr Richardson, in either not knowing—I am being generous in saying that—or lying to this committee—

I must stop you there, Mr Finnie. As you know, it is the convention in the chamber that we do not use that word. The phrase “inaccurate with his account” would be preferred. “Lying” is a very strong word, which we tend to avoid in the chamber, and I would appreciate it if we could avoid it here, too.

Okay, then—I will call it a knowingly inaccurate statement. Is that something that the public would rightly expect to trigger some form of inquiry? If so, who would initiate that inquiry, given that the person who uttered the inaccurate statement, knowingly, was the disciplinary authority for Police Scotland?

On that specific example, our report was quite careful to say that Mr Richardson’s briefing to the committee reflected the initial assessment of the CCU at that time. I suppose that what we said is that the evidence could have been clearer.

As for your general question about a senior officer providing evidence to the committee that was seen to be inaccurate, obviously there should be opportunities to address that behaviour, either through the committee or ultimately through the Scottish Police Authority, which is responsible for the discipline of senior officers.

Is it your understanding that your report will trigger an inquiry into any senior officers?

I am not aware of our report specifically triggering any inquiries into senior officer misconduct.

Who had sight of the report in advance of its publication?

Our report?

Yes.

We provided copies of our report to IOCCO, the Investigatory Powers Tribunal, the Scottish Police Authority, Police Scotland and the Scottish Government.

Who at Police Scotland was the recipient of that report, and who had access to it?

The report was provided predominantly through the chief constable, but it also went to Deputy Chief Constable Iain Livingstone.

And beyond that?

I understand that the circulation of the report was kept very tight for the purposes of factual accuracy checking. That involved Deputy Chief Constable Ruaraidh Nicolson and a member of the CCU.

Would Mr Richardson have seen the report?

No. Mr Richardson would not have seen the report.

Do you have control over who sees the report, Mr Penman?

We would circulate the report to Police Scotland for factual accuracy checking, but it would be for Police Scotland to determine who would have access to the report thereafter. Our dealings with Police Scotland were predominantly with Mr Livingstone, Mr Nicolson and a member of the CCU, with regard to the technical detail.

So you are not able to say definitively who had prior sight of the report.

No. Police Scotland could have shared it with other people in the organisation.

I would like to ask a couple of other questions, convener, if I may.

With regard to the relationship between the professional standards department and the counter-corruption unit, do you, as a former deputy chief constable and senior officer, believe that there is sufficient separation? Can you reassure us that the investigations are fair and impartial?

10:15  

The short answer is that I do not believe that there is sufficient separation. We commented in the report that there needs to be functional separation between the counter-corruption unit and professional standards. We found that the counter-corruption unit is doing work that we would have expected professional standards to do. That has a knock-on effect on those who are subject to the inquiries, who are seen by their colleagues to be interviewed by counter-corruption—there could be implications for people’s reputations. We therefore made clear in our report that there needs to be more separation between the two.

Did you encounter what might be referred to as a “lad culture”?

A what culture?

A “lad” culture.

No.

Not at all.

Perhaps I am not sure what you mean.

I mean a boorish, gender-specific, male-dominated atmosphere.

No gender-specific behaviours came across. We had the opportunity to speak to a number of officers who had been subject to counter-corruption inquiries and the report clearly shows that they raised concerns about the manner in which they had been treated. However, nothing came up about gender.

What is the relationship between your report and any criminal issues or misconduct that it might have highlighted? Do you believe that it highlighted criminal issues or misconduct?

Our report did not seek to identify any misconduct. It is for others to assess our report, consider its contents and decide whether any misconduct proceedings should come from it.

I understand that—I noted your opening statement—but given your experience as a deputy chief constable and disciplinary authority, is it your view that the issues that were exposed were criminal or disciplinary?

We would not identify anything in our report as criminal.

Are there conduct issues then?

Again, it is for others to decide whether misconduct inquiries will arise from anything in the report. As you can see, some of our recommendations ask Police Scotland to investigate some circumstances and, once that has been done, Police Scotland might—or might not—consider whether there has been misconduct.

You do not feel that your professional background means that you can comment on whether misconduct has been exposed.

My role in the inspectorate is to identify where we can seek improvements, and that is what the report does.

Thank you.

Mr Penman is concentrating on the report’s recommendations. Rhona Mackay and Douglas Ross are next on my list, but I think that Stewart Stevenson has a supplementary question.

Yes—a brief one.

In his questioning, John Finnie used the phrase “knowingly inaccurate”—twice, I think, but certainly once. I took from your answer, Mr Penman, an acceptance that the statement was inaccurate, but a rejection that it was “knowingly inaccurate”.

It is difficult for me to say. The evidence that was given reflected the initial briefing. I am not in a position to comment on whether that was done knowingly.

To be absolutely clear, you have no knowledge that, in saying that the inquiry was live, Mr Richardson was knowingly giving a misrepresentation of what he knew. In other words, he was not deliberately misrepresenting the situation—

It might be helpful for members to understand that, at the time—in April—the CCU’s assessment was that the investigation was live. The person who made the initial referral to the CCU was the superintendent who was in charge of the homicide governance review. Effectively, his job was to look after all the cold cases in Police Scotland, one of which would have been the Emma Caldwell case. Given the person who made the referral, an assumption might have been made that the inquiry was live. The reality was that that individual had previously been involved in the Emma Caldwell case—that was the reason for the referral. There was therefore a reason why Police Scotland might have believed that the inquiry was live. Having said that, and as we said in our report, we believe that Police Scotland should have quickly bottomed out the fact that the inquiry was not live.

That is fine. Thank you.

Douglas Ross has another brief supplementary. I will allow brief supplementary questioning if a line is being pursued.

I have a question about a point that John Finnie raised. On the distribution of the report, why did you write to the committee on 20 June to say that you would publish an interim report when, four days later, you were able to say that you would publish a full report? We welcome the fact that we have a full report, but four days is a short timescale within which to change the report from being an interim report to being a full report.

I can cover that. As you will be aware, I wrote to the committee previously to say that the original timescales were going to be pushed out and that we hoped to publish the full report in the week commencing 27 June. That was our timeline. The committee requested that we bring publication forward to Monday of this week, but we thought that that would bring us some timing difficulties. The large part of the report had been done, but we had issues with factual accuracy and getting the report published on time. I wanted to commit to having something for the committee, and we could commit to having part 1 of the report. However, we felt that it would be helpful to have the whole report done so we accelerated our work to get it done in time.

New members of the committee were not present when the deputy chief constable gave evidence on 15 December. What action has Police Scotland taken since then to rectify that erroneous statement?

I am not sure what public statement has been made, so I cannot say what has been done to remedy anything. We are clear that evidence was given to Parliament after the review and, knowing what we know, we feel that it would have been better if that had been clarified.

I assume that Police Scotland would have reviewed the evidence that the deputy chief constable gave in response to the committee’s questions. During your investigation, was there any evidence that anyone in Police Scotland had said to the deputy chief constable that some misleading information might have been given, and that the committee should be informed of that?

Not that I am aware of. However, it comes down to a matter of interpretation of the evidence that was given on the day and a decision about whether it was factually accurate. Our report reflects the fact that it might have been better to have had more clarity around it. However, I am not aware of any statements having been made by Police Scotland.

On the day when the deputy chief constable gave that information, a significant number of people in Police Scotland must have known that the information was not true. The person whom you mentioned in relation to the cold case review knew that it was not a live investigation at the time. He was perhaps surprised at the CCU’s actions in taking the matter forward as a live case. I find it hard to believe that anyone in Police Scotland with any level of knowledge would not have checked whether evidence that was given to the Justice Committee by the deputy chief constable was 100 per cent accurate. I am surprised that it has taken an investigation by HMICS, prompted by media speculation, for the matter to be addressed. I would have expected Police Scotland to look at the issues that you have raised today and at the other evidence that has been given to the Justice Committee, and I am slightly worried that it did not seek to correct the information before an independent report was produced.

We have found no evidence of the position being clarified or changed. We have looked at the evidence and I have offered my professional interpretation of the evidence and noted what might have benefited from greater clarity.

If I understand what you have said correctly, you do not think that there was a failure of leadership within the CCU. Is that correct?

We have not identified a failure of leadership, as such. Our report identifies a number of factors around poor processes. On the back of our experience in this and other inquiries, we have made recommendations that the governance around the CCU should be strengthened externally and internally. We have also suggested that, alongside those improvements, which concern internal leadership and chief officer oversight, there would also be benefit in having some independent scrutiny and oversight of the CCU, and we have suggested that the Crown Office might be the appropriate route for that.

You concede that there was a problem and that better leadership was needed.

We would have expected more intrusive supervision of the inquiry and more awareness among leaders in Police Scotland.

In broad terms, that is how you think that the problem manifested itself.

One of the issues that we have identified relates to the level of oversight. Others include processes and procedures in the CCU.

How confident are you that those issues will be addressed?

I am confident that they will be addressed, in as much as the chief constable has given a personal commitment to accept all our recommendations. I understand that Police Scotland is looking to establish a group that will include some independent people in order to take that forward. It seems that Police Scotland and the Scottish Police Authority are absolutely committed to addressing our recommendations.

You mentioned the Crown Office and Procurator Fiscal Service doing independent scrutiny—I think that that is recommendation 39. The COPFS is also mentioned in recommendations 23 and 25, which relate to data protection, the need to quickly decide whether something is a minor offence or is corruption, and checking issues in relation to minor offences. That is quite a big role for the COPFS, which we know is already under pressure. Do you have any general comments on that?

It simply reflects the legitimacy of the Crown Office and Procurator Fiscal Service dealing with criminal allegations against police officers. In the main, any such allegations would be reported to the Crown. In terms of the CCU, we believe that there would be a benefit in the Crown having oversight of those investigations at an earlier stage.

In serious organised crime inquiries that do not affect police officers, such arrangements exist and work very well. We feel that bringing the Crown into the counter-corruption world would provide the necessary independent scrutiny.

There is also a need for a more expeditious approach to the reporting of minor offences. Is there a delay and a backlog in that regard just now?

We have found from officers that Police Scotland’s CCU has focused very much on data protection breaches. Under strict liability, if people access information without a legitimate policing purpose, that is a criminal offence and they are reported to the COPFS.

We saw some good practice in the north of England, where the police are given guidance on which matters are criminal and can be dealt with as a criminal offence and which are non-criminal and can be dealt with through misconduct procedure. We feel that there is value in considering such an approach for Scotland to effectively allow the Crown to focus on serious breaches, while minor breaches could be dealt with through the misconduct procedure for police officers. That would be a more proportionate response.

Is the working practice in the COPFS different, or are you simply talking about making such an approach more of a priority?

It is more about trying to streamline the processes rather than providing every case to the COPFS as a full case. It is about whether there can be some discussion between the Crown and the police to enable a more proportionate response around which cases require to be prosecuted and which are perhaps best dealt with through misconduct procedure or advice to officers. We are suggesting a more proportionate response to data protection offences.

Are you looking for a front-end discussion, as opposed to having to wait until the decision has been made?

We need to develop the processes further in that respect, but we think that it would be helpful for an abbreviated report to go to the Crown Office, which could provide advice on the best way to proceed and push the matter back into the system for misconduct procedure if that was required.

You brought up the issue of communication, which has been a thread running through many of Police Scotland’s problems. Can you comment on that?

The issue often arises in large organisations and relates to the ability to provide information to staff. We have commented specifically on the way in which Police Scotland passed out information on the changes to the code of practice. We felt that Police Scotland had prepared for the changes. It passed out the information and staff had access to it. However, there was an overreliance on email. We recommend that Police Scotland looks at particular technical areas, and that in future it supplements information with briefings and checks that people have received information.

Okay—I will watch this space with interest.

Douglas Ross has a supplementary.

I have a few issues to raise. Why was a whistleblowing policy not implemented when the counter-corruption unit was set up?

I cannot say, because I was not part of the set-up. Our investigation did not pick up—

Do you think that it would have been useful if such a policy had been implemented?

We have commented in one of our recommendations that Police Scotland should have a whistleblowing policy.

You are looking back at the situation three years on. Do you think that it would have been useful for Police Scotland to have had in place such a policy at the inception of the new unit?

Yes. A policy underpinning Police Scotland’s approach to whistleblowing would have been cascaded through a number of the operating procedures that were in place. That is why we picked up that point in one of our recommendations.

Do you think that that was an error—a deficiency—in the set-up? Were there any other such errors?

We found in our review that a number of policies relating to ethical standards were either still to be finished or were under review. One of our recommendations is that they should be finished. To answer your question, I think that it would have been helpful if, when Police Scotland came into being, a whistleblowing policy had been in place. In fairness, although the policy was not in place, Police Scotland rolled out its confidential whistleblowing helpline. That service is available and has been well used.

I will come on to that in a later question. With regard to the specific policy, it seems that you agree that there was a deficiency in the set-up. Was there a lack of strategic thinking from Police Scotland in setting up the new unit?

I will give an example. At page 37, your report says that three different detective chief superintendents headed up the unit in the first year and a bit after its creation. Is that not an extremely high turnover for a new unit, and does it not indicate that there were major problems with the set-up?

10:30  

Our key recommendation on that matter is that Police Scotland must take stock and consider what it wants from a counter-corruption unit. It has to reconsider and articulate the vision for counter corruption. We are three years on from the unit’s creation, and we are encouraging Police Scotland to look at structures and to create capability and capacity for the unit. When Police Scotland rolled out the counter-corruption unit, it set out some parameters for it. Our view is that, three years on, it must go back, look at the unit and be clearer about what it needs to do.

There was a lot of turnover at a senior level. We identified that that has had an impact on how the CCU has developed.

Paragraph 103 of your report says that, when the unit was set up back in 2013, it was asked to identify potential and emerging strategic trends, yet, in the summer of 2016, we are still waiting for that assessment, which is to get limited exposure. Is it really acceptable that we are still waiting for the unit to deliver an assessment to a deputy chief constable? Who in Police Scotland should be looking at the matter? It should not have to take a report from HMICS—which, as I have said, is very welcome—to highlight that an assessment that was asked for three years ago has still not been delivered.

I agree—to the extent that a strategic assessment is an extremely important document. It helps Police Scotland to understand the threat that it faces and, therefore, configure its counter-corruption services to deliver against that threat. Those are all documents that we would expect to be delivered, and we have made recommendations that they be brought forward.

Finally, on the same point, paragraph 93 suggests that you support the fact that a number of the people involved in the unit have a broad range of experience, and that they are able to get “specialist technical support” from across the force. However, earlier in the report, you highlighted that wider involvement as a risk—as I read it—because more people would be aware of the CCU investigations. How do you marry up those quite different report recommendations?

There are two points in that regard. First, the report recognises—it is a key recommendation—that Police Scotland needs to have the capability and the capacity to tackle counter-corruption investigations proactively. In order to do that, it should have access to specialist operations.

It may be helpful at this point to introduce John Young, who was the head of professional standards and counter corruption at Merseyside Police and is now an associate inspector at HIMCS. I would ask John to give you an idea of the model in Merseyside Police and how that model might suit Police Scotland.

When I was in Merseyside Police, I was the head of the professional standards divisions, which also included the counter-corruption unit. The unit was very much self-sufficient. In terms of its hierarchy in the force, it could look at anything that the rest of the force was doing. For example, if we wanted to put out surveillance, I did not need to go and bid for other resources.

Part of the problem with counter corruption is that corrupt police officers act corruptly only for a very small percentage of the time, so we want to be able to dedicate resources to look at them. In that regard, we could put out our own surveillance. If I needed technical support but, because of the investigation’s sensitivities, I did not want to use our own technical support unit, I could go to other forces or the National Crime Agency. In general, however, I did not need really need to go anywhere to get done the work that we needed to do.

The report highlights that, although the counter-corruption unit does not have that capability in Police Scotland, it provides the reassurance that Police Scotland has the capability so that, if it is required, that capability can be accessed.

I have two other quick questions.

The integrity matters—IM—reporting system comes across in your report as a success. I think that, each month, two to three people have been phoning up the anonymous number and that 11 to 12 are reporting issues using email. I see that as welcome progress, but I am slightly concerned—perhaps you can allay these fears—that there are plans to have another system within IM.

At the moment, if I sent an email to the IM address, it would be automatically deleted, so that the person receiving the email would not know that it was I, Douglas Ross, PC in the Scottish Parliament, who put in the report. Now, it is proposed to have a system with two-way dialogue between the investigator and the person submitting the report. Is there not a risk that that would put off people from reporting confidential matters?

The short answer is yes. We identified that point in the report. We said that, if that approach was developed, strong technical safeguards to provide anonymity would have to be tested. We share your concerns.

Systems are available that allow such an approach to be taken. I could point Police Scotland in the direction of other forces that have such systems.

The software works like this. People have to log into the system, and they get a password. The password goes through, so the people who are to receive the information get a password. They will answer back, and only the person who has the password at the other end can gain access to that reply. If they never access something, they will never see it. The configuration of the system makes it impossible to go back in to find that.

Some forces have systems that allow people to go back, and we could question whether the information can be found in those cases, but there are things on the market for ensuring people’s anonymity, which allows the dialogue to start. Once the dialogue has started, the person involved can potentially be reassured and supported, which allows the necessary information to be accessed for the corruption inquiry to progress properly.

If the corruption inquiry is dealt with properly and the outcomes are effective, the anonymous person can see that. In producing your report, did you find anything to suggest that the CCU is not getting enough information from the initial anonymous inquiry, meaning that it cannot follow through on an inquiry and that it therefore requires extra information? Even after Mr Young’s answer, I am still concerned that such an approach will put people off.

The issue of people being put off is why we have been clear that, if the enhancements are to be introduced, they will need to be thoroughly tested and staff will need to be confident in using them. We have also suggested that staff associations will need to be involved.

Your general question was about whether integrity matters reports provide enough information. The information very much varies; at best, it is anonymous information that identifies potential corruption or misconduct, which leads the CCU to do more work. You raise a fair point about those who raise such matters seeing things happening around them.

Recommendation 36 relates to progress by the vetting section. Progress has not been good, has it?

Our focus was on counter corruption, but we looked at all the functional sections of the CCU, of which the vetting section is one. There is a backlog in processing vetting applications, although I understand that the section prioritises vetting daily to get through the applications and that the section has added staff. We have identified a backlog, which is being addressed.

I worked out quickly on the train this morning that the backlog has gone up from 3 per cent to 9.6 per cent, which is a big increase. I ask again who oversees that. Someone is in charge of the CCU and I presume that they say when their staff are too busy. What level does that information go up to in Police Scotland? Does the SPA look at the backlog? I presume that it looks at a range of figures every month or every time it meets. The fact that the average number of applications has been 400 a month since September 2013 and that the number of outstanding applications has increased to just under 1,200 should raise alarm bells. However, nothing seems to have been done until you reported.

I am not sure about the extent to which the figures have been scrutinised internally or whether they have been put to the SPA; that was not part of our review.

Did you see any examples of the SPA scrutinising the figures?

We recommended that updates on the vetting side should be provided to the SPA. Additional resources have been put into the vetting section, and we are comfortable that, once the new staff are trained in access to the systems, the section should start to reduce the backlog.

The SPA did not highlight the backlog as a concern.

Not during our review.

I will ask a couple of questions about procedure. Will you clarify the procedure for the submission, deletion and resubmission of applications for communications data?

The Interception of Communications Commissioner’s Office released a memorandum and annexes last week, and a hearing of the Investigatory Powers Tribunal will go ahead on 22 July.

I will give some explanation about the acquisition of the communications data. The counter-corruption unit’s working hypothesis was that somebody in a major investigation team was leaking information to a journalist. We know that that hypothesis was flawed, but a part of the investigation was to identify who in Police Scotland was leaking information. The CCU went very quickly, in our view, to applying for communications data, such as subscriber details and itemised billing.

The first application was presented to the designated person, the detective superintendent, who is a trained authorising officer well experienced in covert authorisations. He was independent of the counter-corruption unit investigation; he was independent of and never worked on the Emma Caldwell inquiry. His job was to look at those applications and to make a decision based on the evidence presented.

The first application contained details of a journalist’s telephone number. The designated person was aware of the code of practice—he had been briefed on it. He sought advice from the central communications investigation unit within Police Scotland to ask whether the application required judicial authority based on the revised 2015 code of practice. He was given clear advice that the answer to that question was yes.

The designated person then sent the application back to the counter-corruption unit intelligence section, which deleted the journalist’s number from it. The section then presented that application again, without the journalist’s number, along with two additional applications to the designated person—the detective superintendent. He read them, did not seek further advice from the communications investigation unit and authorised them—they had been through the process.

There was no requirement based on the processes in Police Scotland at that time for the designated person to seek advice from the communications investigation unit or the senior responsible officer. That process has changed now; Police Scotland has put measures in place that the interception commissioner has commented on—they are robust and should prevent a recurrence of what happened.

The three applications that the designated person signed then carried on through the process. They have now been subject to inspection by IOCCO, and Police Scotland has conceded that it has breached the code of practice. That is where we are with the Investigative Powers Tribunal with regard to remedy for those individuals whose article 8 human rights were breached.

You say that there was no need for the intelligence section to go through an oversight process when it resubmitted the applications. Was there no breach of standard procedures?

The procedure was to contact the designated person. There is an annexe in the HMICS report that says that the law states that a superintendent has the authority to authorise communications data—particularly traffic data. An inspector can authorise subscriber data, which is at a lower level. There was no requirement to seek further advice from anybody; that was the process that was in place at that time.

The designated person did not breach any process. Where the contravention of the code of practice kicked in was that the Regulation of Investigatory Powers Act 2000 process was not the right one to apply for data in respect of journalists or to determine a journalistic source—that required judicial authority.

You say that there was no evidence of chief officer involvement. Could you please clarify what level you are talking about when you say “chief officer”?

I am talking about chief constable, assistant chief constables and deputy chief constables. There was no involvement of anyone from that level or the executive of Police Scotland in any aspect of the applications.

The applications went from the counter-corruption unit to the designated person who was a superintendent and who authorised them, as per the processes that were in place. There was no oversight—nor should there have been at that time—by any chief officer. It was routine business—if you remove the judicial authority bit, which was new. Applications for and authorisations of communications data are routine business for policing, and they sit at a superintendent level, which is a senior level within the police service.

Is there no intention to change that? Will it remain like that?

That has changed. With regard to judicial authority, any applications to seek a journalistic source now go to the senior responsible officer who ensures that the proper routes are in place. If there is a requirement to do that, it needs some sort of judicial process. That has only recently been introduced into Scotland based on a letter from the Lord Advocate in April this year.

Will there be any review or on-going oversight to ensure that all the procedures are followed correctly in applications for communications data?

My understanding is that the IOCCO, which has the authority for that, is in Police Scotland this week doing an annual inspection, as happens every year.

Will recommendations perhaps be made from that?

The IOCCO will do the inspection, and if it finds anything it will make recommendations to Police Scotland.

Are you content that the correct processes are now in place, and that there will be no further breaches?

I can quote from the commissioner who is satisfied that the processes in place now are robust enough to prevent a recurrence of the scenario in question. If there is a requirement for judicial authority, there are processes in place to ensure that that and the code of practice will be adhered to.

10:45  

Given the concerns expressed by a number of officers who have been subject to CCU investigations—which I think are picked up on page 9 of your report—do you think that it is possible for the CCU to regain legitimacy among rank-and-file officers?

I think that it is important that it does—in fact, it has to do that—which is why our comments are that the CCU has to operate with the same ethical standards as the rest of the force, and to behave in the same manner as police officers.

What we have picked up, in speaking to officers who have been subject to counter-corruption inquiries, is that a lot of their experience predated Police Scotland and was predominantly from the Strathclyde legacy force—although, clearly, some of that culture has come across into Police Scotland. Those perceptions are something that Police Scotland is aware of and, I understand, is working to overcome. The legitimacy of any CCU unit within a force really relies on it being seen to be credible and fair among the staff it works with.

Given that the CCU has fallen significantly below those standards, and Police Scotland is a relatively new organisation, is there any argument that it would be better for the CCU now to be disbanded and to start from scratch, or to build another model that takes into account the various points your report outlines?

We are in the business of identifying improvement, and I hope that our report sets out a clear path for improvement that Police Scotland can take. As I said earlier, our key recommendations are very much about Police Scotland being clear about what it wants from a CCU and then restructuring the CCU to provide capability and capacity. There is very much an opportunity—in fact, a request from us—for Police Scotland to do exactly that: to make a complete review of its approach to counter corruption, looking at best practice across the country, and to develop something that is fit for purpose and fit for its needs.

In your professional view, do you think that the current CCU is the best starting point for that process, or is it better to take a step further back from that and begin from scratch?

As we saw, the CCU is providing a function that is around low-complexity, low-volume activity. We think that it needs to do more than that. Therefore I think that the CCU provides what Police Scotland is looking for at the moment, but our recommendations are very much firmly rooted in a structural review of counter-corruption activity within the organisation.

On that issue, if you are saying that you do not think that the CCU should be disbanded, what plans do you have to scrutinise—to see that your recommendations are actually being implemented? Is there an on-going plan for that?

What we do in all our reports is to ask Police Scotland for an action plan. I wrote to the chief constable yesterday, with a copy of our final report, and made a request for an action plan to be provided to us. We are also aware that the SPA will take an active interest in overseeing that too, and how it will work. We would look to work alongside Police Scotland as it starts to implement those changes, so that we can make sure that our expectations from the report are carried forward, and to provide assurance to the SPA that the improvements we are looking for have been made.

Could you comment on the role of the SPA? With hindsight, could it have been more proactive in intervening and monitoring what was going on?

I would praise the SPA. When media and parliamentary interest shone some light on to the CCU, the authority made the request for us to do the review, which was helpful.

What we have identified in the report is that there is a need for the SPA to be involved in the general discussions on strengthening oversight of the CCU. That would mean it being provided with regular updates on the general work of the CCU. There is also the point that Mr Ross made around issues such as vetting and other management information being provided to it so that it can assure itself that the CCU is working effectively.

What would you consider to be regular updates?

I think that updates have to be built into the existing board scrutiny. The SPA has a sub-committee structure that should be taking the reports as part of its normal business. The SPA’s public board meetings should take an interest in the progress of the work following this review.

Thank you for coming, Mr Penman. My question is on a point that was raised earlier. What are your plans for testing the enhancement that you mentioned in order to give confidence to staff who report issues?

Does the question relate specifically to Douglas Ross’s question about possible enhancements to the system to allow communication with people who initially make a report?

Yes. My question is a supplementary to Mr Ross’s question.

Without knowing what the proposals are, it is difficult for us to say. What we are saying as a principle is that, with any of the enhancements that are made to the system—we understand that the system was built in-house—Police Scotland has to demonstrate to us and to staff associations, which have an important role in this, that the system has integrity and has safeguards built into it. Our expectation for the follow-up to our recommendation is that, if Police Scotland makes enhancements, it will let us know in some detail what the changes are and what safeguards it has put in place.

For clarification, are there no substantial plans at the moment?

We are not aware of any detailed plans but, in the discussions about enhancements, the view was expressed that that would be a helpful enhancement, and that is why we have identified it in the report, as well as the need for safeguards.

In the “Planning and process” section on page 13 of the report, you have a bullet point about the number of personnel on restricted duties. I would like to get an idea of scale. Is that an extraordinarily high number? Seven hundred days seems like an awfully long time.

To put it into perspective, there are more than 17,000 police officers in Police Scotland and 140 of them are currently subject to restricted duties. As identified in the report, there is validity in having officers on restricted duties if there are on-going investigations or concerns about their access to information.

Our point is that—as you picked out—having 29 officers on restricted duties for more than 700 days seems a while. We did not go into the detail of individual cases but, having spoken to staff associations and officers who are subject to those restrictions, we take the view that Police Scotland could review that situation and see whether there are opportunities to relax the restrictions—to deal with the cases that are outstanding against those officers and perhaps allow them to go back to full duties. In effect, there are 140 police officers who are not available to serve their communities fully.

How does that number compare with other police authorities in the United Kingdom, such as in England or Wales? Do we have any comparisons?

We did not do any comparisons to see whether it was more or less time. Just looking at those figures within Police Scotland, we felt that there was scope to review those cases—certainly the ones that have lasted more than 700 days—to see whether they can be expedited.

Mr Penman, in your key findings, you say:

“Our examination of CCU intelligence files has raised concerns over the routine management, oversight and wider governance of CCU enquiries,”

—and this is the bit that I want to comment on—

“including the extent to which chief officers are actively briefed”.

Yet, in the executive summary, starting at the bottom of page 6, you say:

“there is a clear responsibility for police officers and members of police staff to keep themselves abreast of new legislation and guidance”.

One statement suggests proactivity on the part of the junior orders, but the chief officers are being briefed. There was an issue about who became aware of the changes to arrangements. How does that fit in with the plethora of legislation that police officers have to deal with?

We need to clarify that the key finding in relation to chief officers was an expectation that there would be greater scrutiny of individual counter-corruption investigations by chief officers and so a greater awareness of the detail behind those investigations. Based on that finding, we took the opportunity to go down to Merseyside Police, where we were impressed with the extent to which chief officers take an active interest in the specific investigation lines of inquiry that are being followed. We felt that that was something that could be strengthened in Police Scotland. That is what the initial finding related to.

On the general principle of there being

“a clear responsibility for police officers and members of police staff to keep themselves abreast of new legislation”,

how would that take place?

In that context we were referring to people who have particular specialisms, for example the designated persons. Part of the training of designated persons is to tell them that they have a responsibility to keep themselves abreast and aware of new legislation. They have access to an intranet that provides up-to-date guidance, and there is an onus on those officers—not everybody in Police Scotland but people with those particular specialisms—to keep themselves skilled in and up to date with legislation and guidance. Those resources would be provided for them to keep themselves abreast of legislative changes. Police Scotland would then pass that guidance out. We have said that Police Scotland has relied unduly on email communication and that it should strengthen that to ensure that those who are provided with critical information receive and understand it.

Whose responsibility is it to clarify that all staff are fully au fait with the most recent legislation?

In general terms, the organisation has a responsibility to ensure that staff are aware of legislative and organisational change.

Many thanks.

Does that include the option of audio recording, which is mentioned in recommendation 26? You seem to be suggesting that the SPA should have at least a working knowledge of what is going on there.

The issue of audio recording applies specifically to advice and guidance briefings that are provided. For example, there might be concerns about a police officer or member of the police staff, but if they did not amount to criminality or misconduct, the CCU would have an opportunity to speak to that member of staff and address the issues in question. Under the current system, those meetings can be recorded, if the member of staff so wishes, to provide some safeguards. In our recommendation, we point out that that that option does not currently exist within a standard operating procedure and that it needs to be embedded. When the SOP is done for advice and guidance briefings, including audio recording, the authority and staff associations should be able to see it. The other view would be that all the interviews should be recorded to ensure protections for everyone, but the feedback from staff was that such a move might be disproportionate.

We recognise that audio recording should probably happen at the discretion of staff, but it should also happen as part of an SOP and the staff associations and the SPA should be involved to ensure that that is what the member of staff and the staff associations want.

So the SPA definitely has a role in monitoring the proportionate balance.

I think that, as has been accepted, the SPA has a role to play in the whole area of counter corruption. After all, as far as accountability is concerned, the chief constable is responsible for the policing of Scotland and the authority is responsible for holding the chief to account for the policing of Scotland. My view is that, as counter corruption is part of the policing of Scotland, it is legitimate for the authority to have an active interest in it.

A number of members want to get in, but I will take Ben Macpherson next, because he has not asked any questions yet.

Elaborating on Oliver Mundell’s point about the confidence of rank-and-file officers and moving on from Douglas Ross’s comments about the lack of any previous whistleblowing policy, I wonder whether you can comment further on recommendation 20 and your view on the importance of establishing a formal whistleblowing policy.

Having a whistleblowing policy is key, because it allows staff to understand the position of Police Scotland as an organisation in relation to that and, more important, the safeguards and protections that are available to staff to give them confidence. We know that Police Scotland is actively pursuing its whistleblowing policy and is looking to work with the private and public sectors to identify best practice. That work is on-going, and the new chief constable has given a firm commitment in that respect. The whistleblowing policy is therefore very important, and it will inform a number of other standard operating procedures.

The current online system, which is called integrity matters, is, we feel, an improvement on what was there before, and staff are obviously using it. However, it has also been suggested that there might be an opportunity to put in place another external system that would allow whistleblowing by officers or indeed members of the public. We feel that the whole area is worthy of further thought and review.

Recommendation 20 also refers to “engagement with staff associations”. Can you elaborate on that?

I think that that goes back to my initial point that the counter-corruption unit must have legitimacy to operate, and that legitimacy comes from adopting the ethical standards of the officers and police staff that it is effectively policing. Given that the staff associations are the voice of the police officers and police staff, it is critical that they are involved in developing some of the policies and procedures around whistleblowing in particular. For staff to have confidence in counter corruption and whistleblowing, the staff associations have to have confidence in it, too. We therefore see it as critical for the Scottish Police Federation, the Association of Scottish Police Superintendents, Unison and others to be part of the discussions in that respect and to be satisfied that Police Scotland will protect those who provide information or whistleblow and that the information that is provided will be taken seriously.

Finally, do you think that, in light of your report and the general workings of the CCU, there are any specific things that need to be considered in the development of the general overarching policy?

I do not think that there is anything in respect of the whistleblowing policy for us. We suggested that it should be ensured that there are safeguards in the integrity matters online application. We have made recommendations to improve the internal oversight and the chief officer oversight of the CCU, and we have suggested that there should be some external oversight and scrutiny. I hope that all of that would give confidence that there was greater transparency and accountability in what the CCU does. That is quite an important feature for us, as well.

11:00  

I want to go to two other issues that I have highlighted. Recommendation 5 suggests that there should be

“a more structured approach to communicating changes in legislation”.

John Finnie went over that. However, that is just in regard to the Regulation of Investigatory Powers (Scotland) Act 2000. Is there a need to do that further? I understand that the report is just about the CCU. If there are deficiencies in disseminating information to that one unit, could there be deficiencies in other areas of Police Scotland? Should the SPA or Police Scotland look at approving that across the board?

As you pointed out, we intentionally kept the recommendation very narrowly relating to the Regulation of Investigatory Powers Act 2000 and RIPSA. That is also because the people who are trained in this have a responsibility.

As the convener highlighted in one of her questions earlier, a recurring theme for Police Scotland has been communicating change in an organisation that spans the country and has more than 20,000 staff. It is aware of that, and we have made comments and recommendations in our previous reports about strengthening communication from staff and ensuring that staff are aware of changes in particular.

Have you seen any progress on that?

I think that we have. Police Scotland is developing its internal communications policy and taking feedback from its staff survey. However, we have not physically gone in and checked that.

When you review the action plan and see that recommendation 5 has been sufficiently dealt with, should the SPA use that as a model across all divisions in Police Scotland, or is that very specific to the CCU?

It is specific to the CCU, but you have raised a valid point. The SPA and Police Scotland might see that approach as being worthy of rolling out. Conversely, they might have rolled out some stuff already that is working quite well for them and which they could bring into that. You have raised a general point about the SPA and Police Scotland being mindful of the difficulty in communicating quite complex legislation.

My other question is about paragraph 194 of the report. How many superusers are there? How many should there be?

To be honest, I do not think that we know the answer to that. The general point was that Police Scotland was still working its way through that and there was a potential vulnerability in systems to be tied up. I do not think that we have the number.

But you say that there are too many superusers and their number should be reduced.

No. We are saying that superusers who have access by the back door into information and communication technology systems should be properly vetted, and that work is still on-going. We are asking for that work to be progressed as a matter of priority.

The second line of paragraph 194 says:

“We consider this review is important in identifying and reducing the number of people within Police Scotland”.

If you are saying that the number of such people must be reduced, you must know how many of them there are to reduce.

Although we did not get the number, I think that Police Scotland accepts that there are some people who got access to superuser functions in a previous role that they no longer need. The recommended reduction was based on the view that there are people who have that access but no longer require it.

So how will you gauge whether recommendation 37 has been successful or not? If you do not know the number of superusers when you made that recommendation, I do not know how you can—

We would expect Police Scotland to demonstrate to us how many superusers there were, how many there are, and—

But you did not ask for that when you did your report—that is strange.

I suppose that we identified the issue as a potential vulnerability for Police Scotland in the span and scope of what we did in our report.

Superusers are quite a big part of your report. A superuser could have been involved right at the very beginning if the person was a member of the police staff.

As I said, we identified and reported on a vulnerability. We would track the recommendation by looking to see what Police Scotland had done to identify who the superusers were and how it had rationalised the number of them. I think that there is an acceptance that there are people who have superuser rights across some systems that were given to them in previous roles. It is about tightening up the procedures and processes when they move on so that those rights are taken away from them. It is about the general principle of reducing the number of superusers, as people would not have access to systems. We identified a vulnerability in our report, but we do not have the numbers.

Are you satisfied that you can follow up on recommendation 37 without knowing that?

Yes, because we can go back to Police Scotland to find out what it has done in that specific area, which is one of the 39 on which we have made recommendations. My expectation is that, by the time we go back to Police Scotland, it will have identified who all the superusers are and how many of them do not need to have access to the systems in question. By then, I expect that it will be able to say by how many the number of superusers has been reduced and what processes are in place to ensure that those who continue to have such access are properly vetted and have a legitimate need for it.

Of what rank should officers be to be superusers?

It is not for me to determine that. Police Scotland must determine whether someone who has superuser access has a legitimate need for such access, and it will need to demonstrate to us that it has discharged the recommendation.

I just want to get this correct. You are not telling Police Scotland by how many to reduce the number of superusers or of what rank those officers should be. You are leaving it up to Police Scotland to tell you that it has reduced the number of superusers, but you do not want to specify how many superusers there should be, because you do not know what the original number was.

No. I will clarify the position. We have identified that there is a vulnerability, because there are people who are superusers who it is accepted have access to systems that they perhaps should not have because their jobs have been changed. We have asked Police Scotland to rationalise the number of superusers. I expect that, following our recommendation, Police Scotland will be able to demonstrate to us who all the superusers are and how superuser access has been reviewed, to justify the need for continued superuser access and to have in place a process to manage that going forward.

It sounds as if you have had quite a detailed conversation with Police Scotland about superusers. As part of that conversation, did you ask how many people had superuser access?

No. I am not attempting to justify my position, but that was one of a number of areas across the CCU in which we picked up a potential vulnerability. We identified that vulnerability in our report, but we knew that Police Scotland had already identified the issue and was working through it.

You say that Police Scotland was working through it. Are you confident that Police Scotland had any oversight or any firm idea of who had superuser access, or do you think that that was unknown and unchecked?

We found that Police Scotland had identified the issue, was aware of it and was in the process of working through it.

Do you mean that Police Scotland was aware of the issue or aware of how many superusers there were?

Police Scotland is aware of the issue and is working towards resolving it. Police Scotland has a finite number of information technology systems. It will look at who the users of those systems are and how many of them are superusers. Once it has gone through the process of identifying how many members of staff have superuser access, it will be able to take a decision about whether they should continue to have superuser access and, if they should, what protections will be in place.

We did not go into that level of detail in our report. We identified the issue, and we are satisfied that Police Scotland is addressing it.

From the conversations that you had, could you be confident that Police Scotland knew exactly which individuals had superuser access, or was it the case that, because people had a number of IT accounts, Police Scotland did not know who had access to the system at any one time?

Police Scotland knows exactly who has superuser access. Individual staff have different levels of vetting. The review is looking at who those individuals are at the moment and what the level of vetting is. That element is being reviewed to make sure that there is a match-up between access to systems and the level of vetting. We are comfortable that Police Scotland knows how many superusers there are and who those individuals are. Some of them have different levels of vetting. It is a case of rationalising the vetting of those individuals. From that, we will start to see a reduction in the number of superusers.

Would you be able to make that information available to the committee? Could we request it from Police Scotland?

Yes. Police Scotland should be able to provide you with the number of staff who are superusers and the levels of vetting that apply to them.

That would be helpful, because if we do not know what the starting point is as far as the number of superusers is concerned, it will be impossible to say whether Police Scotland has complied with recommendation 37. We would appreciate that information.

Mary Fee has a supplementary.

I have a brief question on timescales in relation to all the recommendations. I accept that you might well say that it is up to Police Scotland to set the timetable for implementing the report’s recommendations, but at what point will you review that? Will there come a point when a recommendation becomes a requirement? How will you monitor progress on the recommendations that you have made?

Our standard approach is to ask Police Scotland to provide an action plan within three months. That is the normal timescale. I understand that, in this case, the chief constable and the SPA have made a commitment to look to develop that as soon as possible, so I imagine that we will have the action plan before that.

As far as follow-up is concerned, we expect that, once Police Scotland feels that it has finished implementing the recommendations, it will come back to us. At that point, we will review specifically whether we think that the action that it has taken discharges the recommendation. If we think that it does, we will consider the recommendation discharged and will let the SPA know that. If we think that it does not, we will provide further guidance to help Police Scotland to work through that.

You say that you will wait for Police Scotland to come back to you. Does that mean that you do not have in mind a timescale for the recommendations to be implemented?

We have asked the chief constable to come back to us within three months with an action plan. The detail of that action plan has to be developed, and we must be realistic about what Police Scotland can decide. The SPA will have a view about that too, and I am sure that its chair, as well as the chief constable, are keen to expedite matters.

We will work with Police Scotland as it follows the recommendations to see that it has put in place the changes; we will not wait until all of the recommendations have been followed up. When Police Scotland tells us that it has made this change or that change, we will look to see what has been done and will report back on whether the recommendation has been discharged.

So there will be an on-going process of review.

Effectively, yes. However, that will involve Police Scotland and the SPA keeping us updated on progress against the action plan.

I will be briefer than I intended to be, as Mary Fee has covered a lot of what I was going to say.

Sorry.

No, no, that is quite all right; as long as somebody does it.

I want to make an observation, and then I will allow us to move on. Some 33 years ago, when I worked in information technology and had special licence from the US Department of Defense to use software that was described as munitions of war, we were not allowed superusers; we had to use a system of dual or triple authority. In the modern age, the idea of superusers seems extremely antique. Might you explore the introduction—phased, of course—of a process by which dual authority is used instead? It is all very well having someone senior who is vetted to the eyeballs, but they might subsequently be exposed to an event that leads to their suborning their rights as a superuser. The best way is always to have two keys to something rather than one person with a big key. I simply pass on that observation.

I am picking up on the committee’s interest in superusers. We will take that away and consider it in relation to the recommendations so that we can strengthen our scrutiny of the action plan in that regard.

The issue reflects the fact that Police Scotland has an amalgam of eight to 10 legacy ICT systems, some of which were developed in-house, which means that they do not have an auditing capability. That means that, if the CCU asks for some things to be done, someone with administrator rights—that is perhaps a better term than superuser—has to go in and mine information, because it is not readily available. Of course, that applies only to some systems, not all. Again, as the ICT systems develop, that situation should improve.

We also recognise the interest in business monitoring software that effectively sits above all the systems and allows audit of all the systems that are being used for officers. We think that that should be expedited, too.

That sounds like something that I developed and put in the public domain 40 years ago.

The passage in your report that discusses user focus and officers’ concerns about the lack of transparency in the CCU talks about

“frustration by police officers that when they raised complaints against CCU officers, these were not taken seriously or independently investigated”.

That is a serious matter. Can you tell us how many outstanding complaints there are and what their nature is? Do they involve criminal matters or issues of misconduct?

We met 11 officers or former officers, along with their solicitor. We made it clear that we would not look at individual complaints, so I do not have an answer about the number of complaints. We were keen to find out whether there were any common themes around experiences, so that we could put that in our report. On the back of that, we have made a recommendation about increasing the independent oversight of complaints against the CCU and have said that there is a need to ensure that the outstanding complaints are reviewed in a way that involves an independent element.

Of course, if any of the allegations were of a criminal nature, there would be independent oversight.

Yes; there would be oversight that was independent of the Crown. All of the outstanding cases where people remain dissatisfied must be examined so that we can ensure that people have gone through all the avenues that they should have gone through and that matters have been properly and robustly dealt with.

Given the importance of that matter to the general confidence that people should have in the methods that are in place to deal with corruption, have you had any early indication from Police Scotland of whether it is taking action?

11:15  

Yes. My understanding is that Police Scotland has already communicated with the officers’ solicitor and given a commitment to looking at those issues.

If a complaint is issued, depending on the nature of that complaint, would the officer involved automatically go on to restricted duties?

The nature of the complaint would dictate the risk to the organisation. If the complaint was such that there was no risk to the organisation from the officer continuing with their normal duties, they should not be placed on restricted duties. If there was a concern that they might access information systems while on duty, restricted duties might involve taking away their access to those systems. If it was felt that the officer could not be involved in front-line policing, they could be taken away from that role. Ultimately, they could be suspended in relation to a complaint.

Good practice would involve Police Scotland undertaking an informed risk assessment on each occasion to work out the risk to the organisation and to the officer, and putting in place restrictions or protections depending on the individual case.

Is there a concern that there may be people on restricted duties who should not be?

Our view is that it would be worthwhile for Police Scotland to undertake a review with fresh eyes to see who has been placed on restricted duties and decide whether the organisation can release those people or deal with the outstanding cases against them.

There are two issues. There is the issue of fairness and proportionality, but there is also a financial implication—quite a big one, I would have thought—as those officers are on full salary and yet totally redundant to the police force.

That is a valid point. In effect, 140 officers are on restricted duties, which means that in some cases they are not able to deliver services to communities. There might be legitimate reasons why they cannot do so, but we are saying that each individual case must be risk assessed and that, where possible, officers should be returned to full duties if there is no risk to them or to the organisation.

Leading on from that, if an officer was put on restricted duties, would that unfairly affect their future career prospects?

You raise a valid point. If officers have been subject to counter-corruption inquiries and the allegations have been proven to be unfounded, we need to ensure that those people are not tainted in any way. That is about having in place processes and practices to demonstrate that that is the case.

Are you confident in those processes?

We did not look at them in detail, but I think that that might be the perception in the organisation. The users that we spoke to thought that if someone was investigated by the counter-corruption unit they would be tainted in some respects. A powerful quote that came from one of our focus groups expressed the view that the worst thing that you can do to a police officer is accuse him of being corrupt.

Again, it is incumbent on Police Scotland, when such allegations are investigated and proven to be unfounded, to demonstrate that in terms of the officer’s progression.

I want to go back to the issue of the 140 officers and to Mairi Evans’s question. Given the comments on page 15 of your report that there were particular concerns about Strathclyde Police during the transition period, did you make any assessment of where those 140 Police Scotland personnel on restricted duties were based or stationed?

No, we did not. We got our information from Police Scotland, and I am not sure where in the organisation those officers were. Indeed, I am not even sure whether any of those cases could have been legacy cases, as they have existed since that time. Again, we intend that a review by Police Scotland would identify that and, where appropriate, release officers back to full duties.

Would it be possible to have figures from Police Scotland on where the officers concerned were based?

The committee could make that request of Police Scotland, which I imagine would be able to provide that information.

There is one concerning aspect, on which I would be grateful if you would comment. It was pointed out that the procedures relating to the seizure, handling and management of closed-circuit television footage—including recording, lodging and storage—as outlined in Police Scotland’s standard operating procedures on productions, had not been adhered to, and that evidence had been lost.

Yes. Police Scotland has a standard operating procedure that relates to the handling and recovery of CCTV evidence. It is not uncommon for there to be inquiries in which CCTV evidence is taken from public spaces or premises. We took a particular interest in our case study in cases in which evidence had been obtained and yet when we asked for that evidence we discovered that it was not available or had been lost. We looked into that, and it was clear that the procedures had not been followed, which led us to make a specific early recommendation to Police Scotland to investigate the circumstances surrounding those issues.

What implication would that have? How far does that go? If you think that the unit has evidence and then, all of a sudden, you find that it does not, at what point does that become material?

We expect a degree of professionalism in policing from the counter-corruption unit, which means that, with any information that is obtained, the unit should follow the same standards that are followed in the rest of the organisation for recording that information. The unit fell short of the standards in that case.

Is there any suggestion that there was a wilful loss of information or was it just a lack of efficiency? How did the issue arise? It seems quite germane to me.

As I said, we did not go into detail and investigate the circumstances surrounding the loss. When the loss was identified and it was clear that the procedures had not been followed, I wrote to Police Scotland to make it aware of that and to ask it to investigate the issue separately.

How do the police record and highlight information that needs to be made secure?

That is routine business across Police Scotland. If somebody is asked to do something, a note is taken of that and then officers go and seize evidence, which comes back and is lodged through a production book, under the standard operating procedure. That operates really well across Police Scotland. However, on the occasion that we are discussing, the counter-corruption intelligence section seized CCTV evidence from a public space but the section’s processes were not robust enough and it lost that.

That has huge implications for access to justice and many other things.

Yes.

How widespread is the issue? Did you delve any further into it?

No.

We looked at evidence and production handling across the counter-corruption unit and found that there are robust—albeit not consistent—processes in place across the country for counter corruption. However, when we do an audit, it is difficult to identify things that were not recorded in the first place. Certainly, we have no evidence that that was a widespread practice but clearly, in that case, when we asked for the evidence, it was not available. We identified a significant shortcoming in the processes and procedures.

My final question is on the administrative burden. You feel that some things could be dealt with in a better way. Will you elaborate on that?

That is a general point that we found, which goes back to the point about Police Scotland being clear about what it wants from a CCU. At the moment, the unit does a lot of background checks into individuals for various things such as retirement, promotion and medal awards. That takes up a lot of time. The unit gets a lot of work from its service integrity programme, which basically involves checking people’s notifiable associations and their relatives and friends. A lot of work is being done on what we consider to be low-level data protection. Although those things remain valid, the question is whether they remain valid for a counter-corruption unit. Our view is that the counter-corruption unit should not be involved in that low-level activity, but should be much more focused on and proactive in relation to serious corruption. That is how the unit should be configured and where it should concentrate its efforts.

We are coming to the end of the session, but Douglas Ross has a question.

It is my final question. We have spoken a lot about the CCU as a unit, but clearly it is made up of individual officers who are very professional in what they do. They might take quite a lot of the criticism in the report personally. I understood what Mr Finnie meant when he talked about a “lad culture”. I do not think that that was meant as a slur on the people in the unit, but it is clearly a perception that their peers and colleagues have. Some of the CCU’s actions have undermined morale among other officers. Did you get an indication of the morale of the officers in the CCU?

My first question was about the set-up of the whole process and the fact that the unit went through significant managerial change in the early days. Your report mentions a concern on the part of officers that they will become de-skilled. We are talking about highly trained people who have specialities, but given that they do a lot of the administrative work that you spoke about in response to the convener, they might be concerned about losing their skills. What is your general perception of the morale of the current members of the CCU?

As part of our fieldwork, my colleagues and I probably spoke to the majority of the staff in the CCU. Our view is that they are highly motivated individuals with strong integrity. They are frustrated about the image of the CCU in the organisation, which I think came from the Strathclyde Police legacy force and was carried forward into the early days of Police Scotland. A lot has been done by the people who are there now to move the organisation away from that. For example, the management meetings that we said in our report had been discredited have changed and are now held on a more professional footing. A lot has been done.

In the main, the staff we spoke to felt a little frustrated because their expectations about what they would be doing in the CCU with their skills had not been met and they were doing low-level work. That is a challenge for Police Scotland as it restructures and redesigns its counter-corruption capability. It needs to make best use of its staff and their skills.

Are you confident that the many recommendations in your review will be acted on, and that that will transform the unit so that it is fit for purpose and restores the faith of the public and the staff? How confident are you that all the valid points that you have made will make a difference to the unit?

I am confident, for two reasons. First, there is a personal commitment from the chair of the authority that the recommendations will be addressed and taken forward. The chief constable has also made an personal commitment on that. They are looking at how to implement the recommendations—they are looking to develop structures, rather than just put the recommendations into a force action plan along with many other recommendations. We are sensing that there is a real commitment in the leadership of Police Scotland to focus on the matter and get the recommendations delivered.

Although we scrutinise Police Scotland and cannot be definitive about solutions, we are keen—because of the work that we have put in—to work alongside Police Scotland in developing its action plan, to make sure that the plan achieves the outcomes and improvements that we are looking for. I am confident that the issues are being taken seriously by the chair of the authority and the chief constable.

As there are no more questions, it only remains for me to thank Mr Penman, Mr Whitelock and Mr Young for attending today. We appreciate you bringing the report forward. This has been a robust evidence session and the committee will decide, in our discussions of our future work programme, what steps to take next. Thank you for attending.