Item 2, which is our main item of business today, is an evidence session on the interception of communications by Police Scotland. As members are aware, the session will focus on Police Scotland’s governance arrangements specifically in relation to the implementation of the revised rules on the interception and acquisition of communications data. The revised rules came into force in March 2015.
Before I go on, I must express the committee’s disappointment that the four officers whom we invited to appear before us today were prevented from coming, as Police Scotland would not pass the invitation on to them. We will discuss that issue when we consider our work programme. We were also disappointed not to have received answers to all the 16 questions that we issued, although we are grateful for those that were answered.
I welcome Assistant Chief Constable Ruaraidh Nicolson to the meeting. We will move straight to questions from members.
Mr Nicolson, when did Police Scotland receive the codes of practice?
The starting point was the report by Sir Paul Kennedy, which was published and came into force on 4 February, as it did for every other organisation in the United Kingdom. That was the first point at which Police Scotland understood that there was going to be a change in the codes of practice with regard to how we dealt with journalistic material.
Was Police Scotland consulted in the development of the codes?
There was some consultation; you will see that in the timeline that we have provided to the committee. That came from Brenda Smith, who is the senior responsible officer in the force for such material. She was responsible for ensuring that individuals in the organisation knew about and understood the change. You will see that there was a consultation between us and the Government in that respect.
When was Police Scotland aware of the change to the requirement for judicial approval?
The starting point, as I said, was 4 February. There were various iterations, and material came into the force regarding the understanding that there would be a change in the code of practice. Fairly obviously, we understood that the code of practice came into being on 25 March, and that it was in place at that time.
So there was an awareness that a fundamental change was taking place.
Yes, there absolutely was an awareness.
Prior to the incident that has given rise to this meeting today, which took place 22 days after the new code came into effect, was anyone told in writing that judicial approval was required?
In terms of the actual applications themselves? There was communication and discussion in relation to the fact that that kind of application might indeed require judicial approval.
And that was in writing.
There was communication in those terms but not specifically for the applications that we are talking about. More generally, there was correspondence that would indicate that that type of application would require judicial approval.
Has that been shared with the committee, Mr Nicolson?
No, I do not think so.
Would it be possible for it to be shared with the committee?
We can certainly consider that.
Thank you very much.
Who requested the specific authorisation?
The specific authorisation was requested by the counter-corruption unit.
What prompted the unit to initiate that?
What prompted it was what was perceived to be sensitive material going out into the press.
Is it a matter of routine that the counter-corruption unit would monitor press coverage?
Every organisation will no doubt monitor press coverage. We are interested in what the press coverage is. Fairly obviously, the kind of investigation that was carried out in this case is far from routine. It is something that we do not carry out on a very regular basis. In his report, Sir Paul Kennedy stated that it represented about 0.1 per cent of the whole business of what we do across the country, collectively and in this area of business, and of what we use the powers for.
Could you help us understand how we get from a situation where there is a hard copy in the press to the request for authorisation being made? What is the chain of events between the two?
I need to be a bit careful here, as Her Majesty’s inspectorate of constabulary for Scotland will carry out a full review of that. In general terms, if something was in the press, someone would notify the counter-corruption unit, and it would begin an inquiry into it. Then, depending on where the inquiry was, the unit would decide on the investigative strategy for such an inquiry.
At some stage for that kind of material, there would be consideration of whether the unit required communications data. If so, it would need to seek authorisation for that. The level of individual who would need to approve that would depend on the level of information that the unit was seeking. If it was itemised billing for the purposes of trying to identify an individual for a phone number, that would require the approval of an inspector or above. If we wish to understand who calls are being made to and when using traffic data, that would involve a superintendent or above.
Were you concerned about the press coverage?
I saw the press coverage. We see press coverage every single day of the week. Yes and no. It is one of those things. There are reports in the press every day, and if I was to be concerned about every single article in the press, I would do nothing but worry every single day of the week.
Of course I would say this, but the press are absolutely entitled to investigate and understand what is going on, and to put that out into the public domain. That is what democracy is about. That is what happened in this case.
The document that is in the public domain states:
“The main purpose of the meeting is to discuss Police Scotland’s governance arrangements specifically in relation to implementation of revised rules on the interception and acquisition of communications data, which came into force”.
That is why I am trying to understand this. I may be wrong, but my understanding from what Mr Richardson said was that there was general concern at senior level about the particular press coverage. There is also a suggestion that the concern originated from the murder inquiry. Who prompts something that leads to a request for authorisation?
Anybody could prompt it.
But who did?
An individual from within homicide review and investigation.
Was that a live murder inquiry? I appreciate that all unsolved murders remain open.
That is absolutely something that HMICS will consider. That is part of its review. It published the terms of reference yesterday for all of that element. I would not wish to go into the detail of that at this time.
But it is to do with governance and it relates to this particular incident. I am trying to understand whether such matters are initiated from within the counter-corruption unit or whether someone external makes a request to the unit.
Someone external makes the request.
Who is that person?
As I say, that will be part of HMICS’s review, which will report to Parliament, I believe, in due course.
Forgive me—I should have rephrased the question. What is the post or position of the person who made the request—rather than the individual?
I think that we need to wait for HMICS to consider the entirety of how the situation came about. That is in its terms of reference—that is what it will do. It will report back to Parliament on that in due course—without me undermining that investigation or review at this time.
I would like clarification on a general point. If it was thought that a murder that had taken place some years ago had not been adequately investigated and a police officer—possibly one who had been involved with the investigation but possibly one who had not—spoke to a journalist, would that be a matter of concern to Police Scotland?
Ultimately, that element of it would not be. However, the fact that sensitive material about a continuing murder inquiry had got out into the public domain obviously would be a concern. These inquiries carry information on a huge number of witnesses for no other reason than that they are witnesses in a murder inquiry, and the public would rightly expect us to protect their details and data as far as we could. Nevertheless, I absolutely understand that a balance needs to be struck—that is what this is about—between privacy, under article 8, and freedom of expression, under article 10. We would be concerned about the fact that sensitive information had got out into the public domain but, equally, we understand that we need to be challenged by a free press—that is absolutely right.
I have two or three more questions. Would you say that there was uncertainty about the arrangements at that time, Mr Nicolson? Would that be a fair summary of it?
Uncertainty?
Uncertainty about the level of authorisation that was required.
Absolutely. Sir Anthony May comments on that in his half-yearly report. I could dig that out if that would be helpful.
While you are looking for that, I will ask another question. On the small number of occasions on which such action is required, would it not be the norm to have all matters referred to senior officers?
Yes.
Did that happen?
That is part of my action plan.
I am sorry—I do not mean after the event.
Well, my action plan aims to deal with the issues as I saw them in terms of what went wrong and why we did what we did. I make no excuses for what we did, and I do not want it to come across as though I am making excuses. I will give you explanations for why we have ended up where we are, and there is an action plan, which I think you have seen. That action plan addresses the things that I thought needed to be changed to ensure that we never find ourselves in the same position again.
Was Police Scotland involved in determining the terms of reference of HMICS’s assurance review, which I understand were agreed just yesterday?
I have had no part whatsoever in that.
Was Police Scotland involved in it?
I do not know.
You are not aware of that. Okay.
I have a couple of final questions. I understand that Police Scotland confirmed that the Regulation of Investigatory Powers Act 2000 had been used on seven other occasions for the purposes of identifying journalistic sources but that none of the seven applications concerned journalists directly. Is that correct?
Yes. None of the applications themselves concerned journalists; they were about journalists’ sources.
You are privy to that information.
In terms of?
You can say that with some assurance. It has been suggested to me that at least one of those seven applications concerned a journalist rather than simply a suspected journalistic source.
All of them referred to journalists—there is no question about that. We have said that. However, the applications themselves were focused on and concerned about a journalistic source.
Not a journalist?
Not a journalist, no.
Is the information that I have, which states that one related to a journalist, incorrect?
Fairly obviously, it refers to a journalist—there is no question about that—but it was trying to get to the journalistic source.
Clearly, they all involved journalistic sources, but did one in particular involve a journalist?
I do not know.
Thank you, Mr Nicolson.
I have a follow-up question on the timeline. On 15 December, I asked Deputy Chief Constable Richardson whether he was investigating what Police Scotland thought was a leak after or prior to the Lord Advocate’s instruction that resources be put into the case. He could not give me a direct answer at the time but said that he would get back to the committee on that. Are you able to give me that information?
I am sorry; I missed that. Will you repeat it for me?
Were you investigating what you thought was a leak prior to the Lord Advocate’s instruction?
10:15
Yes.
How early was that?
Again, that is part of what HMICS will review, but my understanding is that it was early in April that we were carrying out investigations into the material that was in the press.
So at that time there was not an active murder inquiry; it was a review case, as Deputy Chief Constable Richardson said.
Yes, in general terms. As I say, the detail of that will be examined by HMICS.
Thank you.
Good morning. Police Scotland has emphasised that the breaches were a result of inadequate internal communication and a misunderstanding of the legislative process. Problems with communication seem to be a feature of the new Police Scotland, most recently in the staff survey. Could you expand on the communication process surrounding the guidance on the code of practice—a kind of A to Z of exactly what was done?
We have single points of contact; at that stage, we had four single points of contact. A single point of contact may include a number of accredited officers. We have three single points of contact across the country, and we had one in the counter-corruption unit. The SRO circulated the material to all the SPOCs and a number of other individuals, including the counter-corruption unit, but the material did not get to the SPOCs or the SPOC in the counter-corruption unit.
To whom?
To the SPOC—the single point of contact.
Why was that?
Because it was not circulated to them.
So what fell down? What did not happen that should have?
The management in the counter-corruption unit and the SRO both believed that the material had been circulated to the SPOC within that unit, but it is quite clear from my review that that had not happened.
What kind of checks and balances would there normally be to ensure that information as important as that was circulated?
Checks ought to have been carried out but, as you will see from my action plan, one of the actions that I have taken is to remove that single point of contact from the counter-corruption unit completely. That is intended to prevent that breakdown from ever happening again.
So there was no one person with responsibility for it, and everyone assumed that someone else had done it.
That is it in a nutshell.
Are you confident that you have addressed that now in your action plan?
I am confident. There is no single point of contact in the counter-corruption unit, so any inquiries of that nature carried out by the counter-corruption unit in the future would have to come out to a completely independent unit.
Would you agree that what happened, as described by DCC Richardson, left the force
“a little vulnerable in terms of completeness”?—[Official Report, Justice Committee, 15 December 2015; c 5.]
It left us very vulnerable, to be honest.
I will go back to something that Alison McInnes raised. You stated that the Lord Advocate’s instruction to reopen the case of the murder of Emma Caldwell was subsequent to the investigation into journalists’ sources. Do you think that the Lord Advocate was prompted by the press coverage of the investigation into reopening the case?
I cannot answer for the Lord Advocate.
No, indeed, but it seems likely.
I do not know, to be honest. I suppose that one of the questions is whether the press coverage accelerated our inquiries into that. That is something that we have to take on board. Fairly obviously, when new material comes either into the public domain or to us confidentially, we take it forward. On the face of it, new material came in in the form of the press coverage.
The two things are not mutually exclusive; I have no doubt now that I am in territory that I ought not to be in because of the HMICS review, but those two are not mutually exclusive. We could have the inquiry into the release of the sensitive material and we could carry on with a murder inquiry. That is what we ought to be doing.
I am trying to understand what happened on training following the revised code of practice coming into effect on 25 March 2015. We know that Home Office PowerPoint training documentation covering journalistic sources was uploaded on 30 March. I gather from what you suggested earlier that there may have been difficulties communicating that internally to everyone concerned. However, by 6 May, there was a teleconference. Can we say that, by 6 May at the very latest, all the relevant people would have been aware of the changes and of the importance of understanding what “journalistic sources” meant?
By 6 May, definitely. There would be some interpretation in terms of what that understanding was intended to be. There were a number of stages. At some stage, people would have had the actual code but, fairly obviously, the crux of the issue is the misunderstanding of what that code meant. That is why we find ourselves in the position that we find ourselves in.
On page 9 of Sir Anthony May’s half-yearly report, it says:
“The use of the text ‘....which is made in order to identify a journalist’s source’ could have been clearer. It appears to indicate that if the source is already known to the police the restriction on the use of RIPA does not apply”.
He then goes on to talk about the text around the word “determine”.
Without going into the detail of what might come out at an investigatory powers tribunal at a later stage, that is unfortunately what is at the heart of what has happened.
As regards any further training opportunities between 6 May and the Interception of Communications Commissioner’s Office visit between 15 and 17 June, was any further training going on? What further discussions were taking place about the issue in general terms?
In general terms, we became aware that there was a breach of the code and we had the inspection between 15 and 17 June. I was then asked by DCC Livingstone to carry out a full review of what had happened and why it had happened; to make recommendations on what to do to prevent that from happening again; and to report to IOCCO.
My action plan is there. The aim is to ensure that everybody in the organisation has all the material on what is required of them. It also deals with a range of other points that I covered in my review.
I was trying to get at what further training or consideration of the issue in general terms was taking place between 6 May and 15 June.
On 6 May, everybody got the overview of what was meant by the code. That training was available to them. The material was available on the force intranet and on other media. However, that would mean people actually going in and reviewing the material themselves.
DCC Neil Richardson’s evidence to the committee on 15 December 2015 was to the effect that the problems arose because of a “misinterpretation” of the code of practice and he accepted that there had been confusion about what was involved in the 22 days after the publication of the code. Was it a training issue or a misinterpretation issue?
Potentially, it was both. It was a misinterpretation issue, in terms of what the designated person understood at that stage. I am guessing that, if he had had the training that he got on 6 May, he might have come to a different determination, but I am straying into what might be discussed at an Investigatory Powers Tribunal.
But following 6 May, there was no sense that further training was required—nothing happened between 6 May and 15 June. Is that the case?
Yes. It was on 6 May that the detail came out on how to interpret the code, and Sir Anthony May’s report, which gave more detail on how the code should be interpreted, came out in July. It went into a fair bit of detail on exactly what was required.
I will leave it there.
There is something that I want to clarify. If what happened had happened 22 days earlier, we would not be here. There would be no case to answer.
We would hope that, if people had had the necessary understanding, had read the various reports and had understood what was in the training material on 6 May, we would not be in the position that we are in.
That is because the breaches relate only to the modification that was made at the last minute.
Yes—the last minute in the sense that we understood in February that the change was to be made. There was not wide-ranging consultation and there was not a huge amount of time to circulate material and to better understand exactly what was required under the code.
So if the superintendent had made the same application a month or two months earlier, it would have been fine.
If the same application had been made two months earlier, it would not have required judicial approval.
So the only difference is that the new procedures were not followed.
We are saying that the person who made the application did not know about the change, but is it possible that they could have known about it? We believe that they did not know about it.
At the end of the day, the important person in the process is the person who authorises the activity. Again, I am straying into the work of the Investigatory Powers Tribunal, but that person will say that they knew and understood that the code was in place but that they misinterpreted it. The individual in question is highly trained, is a person of huge integrity and, unfortunately, is one of the best officers in this area of business in the whole country, by which I mean the whole of the United Kingdom. That is what makes what has happened even worse from our perspective.
Could you remind me of when the annual inspection by IOCCO took place?
Between 15 and 17 June.
According to the information that we have been given by Duncan Campbell,
“Informal confirmation of the inspection was given to Police Scotland on 6 March 2015 and the official intimation was made to us”—
that is, Police Scotland—
“on 23 March.”
I am slightly puzzled about the fact that, given that it knew that IOCCO was going to inspect it, Police Scotland had not checked that it was fulfilling the requirements of the code that had not been changed. I would have thought that the fact that an inspection had been flagged up in March might have suggested to people that they ought to make sure that they were following the correct procedures.
That is what we do every year. We get highly positive feedback every year, although recommendations are made—there is no question about that. We know that we are going to get inspected every year—we get inspected once a year by IOCCO and once a year by the surveillance commissioner. That is why we try to set high standards and, in the main, we adhere to them. Unfortunately, on this occasion, we did not.
What is puzzling is that given that there had been consultation with Police Scotland about the changes, senior people in the organisation would have been aware that there had been a change to the code of practice and, knowing that an annual inspection was coming up, would have seen it as part of their responsibilities to ensure that others who would be exercising duties knew about the changes. I am confused as to why that did not happen. That seems to be poor management.
10:30
No one is suggesting that the individual in the case did not know that the code had changed.
Do you not think that there was a responsibility for senior management in Police Scotland to ensure that the code was being adhered to? They had been consulted by the Home Office.
Yes, in general terms. As far as the senior management of Police Scotland were concerned, the information had been circulated. The difficulty for us is that it depends on how you interpret it. I have already talked about the breakdown in communication in relation to the single point of contact in the counter-corruption unit. We accept that that should have been better managed and there is no question about that.
I have already said that the individual concerned knows the area of business inside out but unfortunately he misinterpreted what the change meant.
Did the senior responsible officer at any time warn that the requested monitoring was against the rules?
On a number of occasions, the senior responsible officer will have spoken about the new change and had dialogue in relation to particular applications.
Did she express concern about the applications?
Again, I am straying into HMICS’s area. She would not have seen the applications.
She would not have seen them?
No.
How can she authorise them if she has not seen them?
The senior responsible officer did not authorise those applications. The SRO’s responsibility is not to authorise; it is to make sure that processes are in place to ensure that the codes are adhered to. The person who signed off the authorisations is a completely different individual.
Nevertheless, did the senior responsible officer express concerns about using the power to investigate the particular case?
In more general terms, she expressed concern about applications for journalistic material.
Was she overruled?
No.
What kind of checks and balances are in the system if someone says that they are not entirely sure that something fits with the new code of conduct? Is there an opportunity for someone else to review the application?
The designated authorising officer would review the material. The way that they do that is to get advice on the legislation. They can get advice on a range of things. In this case, the person who potentially knows most about it would be the senior responsible officer.
When the officer focuses on the application itself and goes to authorise it, they will look at what is contained in the authorisation and make their judgments based on what they know about the law and human rights and whether the application is necessary, proportionate and lawful. That is a single judgment for them to make.
Yes. It clearly was not proportionate or legal. We know that, having seen the IOCCO investigation.
Can you remind me when you were instructed to review and produce the action plan?
That was 8 July.
That was in July and yet you said earlier in response to my colleague Mr Finnie that you were aware of all the press coverage round the particular case. There was speculation in the press for a long time that journalists’ sources were being spied on. Was there any concern in Police Scotland about that aspect of the press coverage?
In terms of what?
Was there no concern about that speculation in the way that there had been concern earlier about the other speculation about the murder inquiry?
If I understand your question correctly, you are asking whether we look at all speculation. Is that right? Is that what you are asking me?
Were you aware of the regular speculation in the press that spying on journalists’ sources was on-going within Police Scotland ahead of your action plan in July?
I am not sure that that is correct. I know from Sir Paul Kennedy’s report that it was not a widespread review of journalists or journalists’ sources. It was a one-off case, so we do not do that every single day.
No, but that one-off case led to fairly regular pieces of journalism in the Scottish press, and as the story unfolded—well ahead of IOCCO coming to a view—part of the story was that the police were spying on journalists’ sources. Is it the case that Police Scotland did not respond in any way internally to those allegations and did not review what it was doing?
We always review what we are doing. The purpose of the legislation and the code of practice is to ensure that there are safeguards in place to prevent us from acting in a disproportionate manner, acting illegally or acting outwith what the code suggests. In considering what we would do, each case would be taken on its merits. We would not have looked at every single journalist’s report. We were concerned about the sensitivity of the material that was going out to the press and about the fact that, if a murder inquiry came to a court process at a later stage, there was the potential for that to cause problems for the court and for us and that it might undermine the case at that stage. Quite rightly, we were concerned about that, but nobody is suggesting that we should not do that; we are suggesting that we should follow the right processes, and clearly we did not follow the right processes in this case.
Are you aware of whether the senior responsible officer raised concerns following the press coverage? Did she perhaps increase her briefings on what was appropriate?
No, I do not think so. You will see from my action plan that every single request of that nature, not only for journalists but for certain other professions, will in future go through the senior responsible officer. We no longer have a separate single point of contact, and every single request that comes in will go through the senior responsible officer. All of that is part of what I put in place, in consultation with the senior responsible officer and with other people. It is what we felt we needed to do to raise the bar back up to where we thought we had the bar previously, which was that we were getting significant support for the work that we had done. On any level, the issue is not good from the organisation’s perspective.
We heard on 15 December that there were five authorisations and two of them were internal to the CCU. Can you talk a little bit about how those were granted and the processes involved?
That takes us directly to independence of the individual, and the codes and material take us through all of that. If the individual had no understanding of, was not responsible for and had nothing to do with an investigation, they could independently sign off the authorisation. For itemised billing, that involves understanding whose phone number it is and who the account holder for the number is. In the past, an inspector could undertake that work. They were in the same unit, but they were not involved in the investigation, so under the old code they could independently review the authorisation, and under the old code an inspector could sign off a subscriber check. I have removed that from the counter-corruption unit, so that unit can no longer undertake that kind of authorisation. The authorisation is now completely independent and separate.
I am trying to work out how the authorisations would have been put in place in the first place. Were they inherited from legacy forces or were they a new set of arrangements?
Some of the investigations would no doubt have been inherited but, to be honest, that is not my area of business. However, no doubt investigations from legacy forces and the Scottish Crime and Drug Enforcement Agency would have been amalgamated and processes would have been pulled together for that.
You spoke earlier about raising the bar back up to where you thought it should have been. Did some things slip in the setting up of the organisation or in a particular unit?
I personally think that, because we had a separate single point of contact, there was potential for that. In my action plan, I have removed that, and the organisation has agreed that we should do that to ensure that the situation does not happen again. No doubt, beforehand, there would have been the argument that problems would not happen and that people would have training. The people who are in the single points of contact have intensive training. They have six weeks of training before they go on an official training course at the College of Policing, so they ought to be at the same standard. However, we looked at what happened and I decided that we should put the bar back up to where we thought it was before.
So you are saying that they have six weeks of training and intensive training but they still misinterpreted straightforward guidelines.
Each single point of contact has accredited officers, who have six weeks of internal training and then a two-week period of intensive training at the College of Policing, which ends with a pass or a fail. They have significant training. Obviously, our expectation is that they are the gatekeepers and they ought to prevent such issues from happening. However, as I said, we had a new code and we find ourselves in the position that we are in.
Thank you.
Perhaps I should have asked this question earlier, Mr Nicolson, because it relates to the inspectorate’s assurance review. Inspections were done previously in relation to stop and search and armed policing, and throughout that period the Parliament continued to monitor both those issues intensively. Is it your view that the existence of that assurance review somehow fetters you in what you can say to us today?
I do not think so. HMICS was specifically asked to carry out a review of those elements, and it will have gone into much more detail than I could and might have found things that I had not looked at in terms of my part of the review. I do not think that my argument is as you describe; I am suggesting that you will get the best information from HMICS because, according to the terms of reference for its review, it will look at the entirety of what has happened.
Of course, we might yet have Mr Penman sitting before us. However, you are sitting there at the moment, so we want the best from you. If you felt previously that you were fettered in saying something, please feel free to say it now.
I hope that I am giving you my best.
Okay. Are you able to tell me the ranks and positions of the officers who overruled the detective superintendent who warned that the planned monitoring was against the rules?
Overruled?
Yes.
I do not accept that an individual was overruled in terms of that.
Who took a different view from the detective superintendent?
You are talking about the SRO who provided advice in relation to journalistic sources, and the designated person who authorised. They are the same rank.
We are talking about the person who took a different view and warned that what was planned was contrary to the rules. Were you aware of that?
Was I aware of what?
Were you personally aware that advice had been given that what was proposed was contrary to the rules, although it went ahead nonetheless?
I am not sure that it is quite as straightforward as that. In general terms, I am aware that the SRO provided advice that such applications could breach the code.
So why are we here? People expect Police Scotland to adhere to the code.
10:45
I agree. I would rather not be here having to explain what happened. I would rather that we had not breached the code and did not have to do this. That would be the best possible position for us to be in, but unfortunately we breached the code.
Fairly obviously, you have a role to play in understanding exactly what happened. I am here to explain to you exactly what happened. That will be bolstered by the investigatory powers tribunal, as a result of which more information will come out. It will deal with a load of things that no doubt I have strayed into—that might cause me issues later, but that is fine. It will also be bolstered by HMICS’s review, which ought to provide you and the public with the level of information that you require. Although we got it wrong by breaching the code, I hope that we will be able to reassure you that, as a result of what we have put in place and my action plan, it can never happen again.
Mistakes happen. Police officers make mistakes and politicians make mistakes. The issue is about the aftermath of and response to a mistake, and what prompted it. Was Mr Richardson aware that the detective superintendent had warned that to take that course of action would breach the rules?
I doubt it, but you would need to ask him that question.
Have you had the opportunity to review Mr Richardson’s evidence to the committee in December?
I listened to his evidence.
Do you believe that the information that we have been given since then fills the gaps that were evident in his evidence?
I hope so, but that is a judgment for you, not me. I have come here to try to provide you with as much information as I can. I am trying to strike a sensitive balance between the information that you want, the information that the IPT will have and the information that HMICS will have. I hope that, ultimately, when it comes together, all that information will give you everything that there is to know about what happened.
One challenge that we have is the growing perception that the reason why you are sitting there rather than other officers is that chief officers in Police Scotland want to frustrate the possibility of the officers coming here. The officers would tell us that, rather than some misinterpretation, it was a conscious decision, which would reflect poorly on the judgment of the CCU and chief officers. Is that not the case?
No, that is not the case at all.
Would you be perfectly happy for the officers to attend? They would not be on oath, but as a parliamentary committee we would expect the courtesy of people telling us the truth.
Of course. The point about the individual officers is that a tribunal is coming up. We are concerned that they could undermine, with what comes from their own mouths, what might happen at the tribunal. We have had legal advice on that.
The second element is that the officers are at the heart of our response to serious organised crime and very serious criminality. Obviously, people already know their names, but we do not want their identities out there. We do not want people to know who they are, their addresses and whatever else, as that would raise risks. That is our concern.
Why would their addresses be out there?
If they come here, they would be seen on TV by everybody. A range of people would recognise them.
Do you understand that, as a parliamentary committee, we would want to act responsibly? We would not expect anyone to compromise themselves and we would not seek to compromise the safety of any individual, but we cannot accept this prevarication. You would probably not be here if Mr Richardson had been frank with us.
I will not comment on that; it is a decision for you to take. I hope that you feel that I have been frank and up front. I am not trying to frustrate.
As a police service, we absolutely understand this committee’s role; for the avoidance of doubt, I state that we support it. We want to give you as much information as we can. We will give you all the information—we will give you more information after the IPT.
What is the area of additional information? I refer to the generality of what you feel you will be able to give us subsequently.
I would think that there will be details about what individual officers did and their consideration of the matter.
Why can you not provide that information now?
I do not want to stray into what the IPT may wish to consider at a later stage.
I understand that you are saying that there are aspects of the information that you cannot divulge now because there could be a conflict with the inspectorate’s investigation. Can you clarify for my understanding that the situation is that the senior responsible officer raised concerns and that another officer of the same rank dismissed those concerns and said that the investigations could go ahead? Was that officer a member of the counter-corruption unit?
No. It is not as straightforward as the senior responsible officer providing advice and the other officer having that advice and dismissing it completely. In all of this, the designated person who signed it off knew that the codes were in place and that they had changed. They considered them, misinterpreted what was meant and authorised.
Has that officer ever been involved with the murder investigation?
Not that I am aware of.
Good morning. Since you became aware of the breach, have you spoken to any of the officers involved in the authorisation process?
As part of my review, I spoke to all the officers involved. I carried out a review into all the circumstances and I reported, through Deputy Chief Constable Livingstone, to IOCCO. That report obviously formed part of what IOCCO ultimately decided in its determination.
Did the officers express concerns at the time that they had been tasked with carrying out these authorisations—that they had been put under pressure?
Not at all. This is a process that goes on. Sorry, this part of the process—looking at journalistic material—is not something that goes on regularly; it happens very irregularly. However, the process in terms of communications data goes on regularly. Our people probably go through that process daily. Someone will apply for that kind of material because they believe that it is relevant. The accredited officers will review the application to ensure that it is in the right format and—as best they can—that it is proportionate, necessary and lawful. They pass the application to an authorising officer who will look at what is contained in it without knowing anything else about the investigation, so it is absolutely about what is contained in the application. The authorising officer makes a determination one way or the other, and there is no detriment to them whatever—they either authorise or do not authorise.
You said that this does not happen every day and then you said that officers deal with these issues every day. What was so different about this particular authorisation?
It was about journalistic material. My area of business is serious organised crime and terrorism, so we use the legislation day to day in relation to serious crime and perhaps not so serious crime, missing people, abductions and a whole range of issues—including many occasions when life is at risk. Those areas are the crux of what the legislation is there for, and they make up the bulk of what we investigate. Individuals in my area look at that day to day across the whole country. What I said was that we do not look at journalistic material regularly—we do that very infrequently.
One of the main changes made in the legislation is that when you intercept journalistic information, you should get judicial authorisation. From my point of view as a layperson, when I read that part of the legislation it seemed quite clear. I find it hard to understand why an experienced officer misinterpreted the rules on journalistic information and judicial authorisation, which seem clear to me.
What else differed in the code of practice? What was different from the recommendations in Sir Paul Kennedy’s report of 4 February, which was shared with relevant officers? How did things change over the consultation period?
Paragraph 8.9, on page 37 of Sir Paul Kennedy’s report of 4 February, says:
“After careful consideration of all the evidence we have collected and reviewed in this inquiry and due to the sensitivities and complexities of the considerations required when contemplating an interference with Article 10 of the Convention we make the following two recommendations”,
the first of which is:
“Judicial authorisation must be obtained in cases where communications data is sought to determine the source of journalistic information.”
That is what was in the report of 4 February and, as I think that I said, that was the first time that we knew that the code would change. The code is slightly expanded to take intermediaries into consideration, but there is not much change from the original recommendation.
Was it in the view of senior officers in Police Scotland for a considerable time, so it was just a case of relaying it down the ranks?
That report came to Police Scotland on 4 February. There was consultation and a degree of trying to understand what was required and whether that could be done in the timescale. We can debate whether there was enough time; we suggest that we could have done with more time. Indeed, Sir Anthony May, in his half-year report, suggests that that is the case, not just for Police Scotland but across the country. There could have been more consultation.
I am sorry. I do not mean to diminish the severity or enormity of what happened; I am trying to explain why it happened. We accept that it should not have happened.
What is happening with the murder investigation now?
Murder investigation is not my area of business. There is a live, on-going murder investigation. I would not want to stray into that, for obvious reasons, but I hope that the on-going investigation will bring us to a conclusion.
You have said that you are not trying to excuse what happened, and I am grateful to you for that.
You will agree that Sir Paul Kennedy’s report was a high-profile one. He reported directly to the Prime Minister, it was national news, and there was a lot of discussion in the public about the matter. I would have expected officers whose main job was to be au fait with the most up-to-date interpretation of such things to be alert to the issue, whenever the communication came to Police Scotland.
Now that your action plan is in place, is it doing what you hoped that it would do? Are you comfortable with it? Have there been applications for similar surveillance, and have they been refused?
In more general terms, we would not answer that question, but at the moment the answer is no.
There have been no further applications. Will you keep an eye on the approach to see whether it works?
Yes.
Good.
We absolutely will keep an eye on things. I am not being flippant about this; it is not comfortable for me to have to come to the committee and explain why we got something wrong. I understand why I must do so—that is fine; it is part of the process. However, I promise that I will be doing everything that I can do to ensure that I never again see you in such circumstances.
11:00
Action plan point 4 reads:
“A Chief Officer briefing/notification process to be implemented to ensure full consideration is given to Article 10 of the European Convention of Human Rights prior to embarking on any investigation relative to unauthorised disclosure of information to the media.”
Is that an action point that you have put in place?
Yes.
Should not that be happening routinely? Are not impact assessments done for every aspect of Police Scotland’s work to ensure that the work does not breach article 10?
Yes. That is among the considerations of the authorising officers, in terms of investigations—
Forgive me. I mean generally that every aspect of Police Scotland’s work should be subject to impact assessments to ensure that they do not breach article 10.
Yes.
Then why are we putting that action point in place?
In general terms we would do that, but the action plan is about certain professions. The commissioner’s report will talk in more general terms about what the chief officers ought to stress in relation to article 10. That might be general advice for the force, so we would do that, but I wanted to make sure that in every single case in which certain professions were involved—including journalists—a brief would go to the senior ranks within the organisation to ensure that they scrutinise and to ensure that they are comfortable, individually, that article 10 will not be breached.
There is also suspicion in committees that impact assessments are just boxes to be ticked, so that people can say, “Yes—it has been impact assessed.” I think that you have confirmed today that that might be the case, if you feel that there is a necessity through your action plan to put a person in place specifically to look at that issue, when it should be something that is fundamental and regularly on-going throughout the force.
I agree: your point is well made. I hope that it is not box ticking, and do not think that it is.
However, for certain professions the sensitivities that are involved merit the issue going to a chief officer to sanction the inquiry’s being continued. That is why I included that action point. I did not intend to suggest that people are not considering ECHR elsewhere. I want to ensure 100 per cent—this is what I meant earlier when I spoke about raising the bar—that we never find ourselves in that position again.
It clearly seems that such work does not run through the whole police force or we would not be here again today.
I will ask you one final question. I do not pretend in any way, shape or form to have kept up to date with the media reports or with the Emma Caldwell case, but it seems to me that there is a balance to be struck. It seems that a lot of priority and attention were given to looking at sources. You can correct me if this is wrong, but from what I understand, there was media coverage—perhaps criticism—saying that something had been missed in the investigation and that it was not going as smoothly as it should. Then, rather than going back to look at the investigation, the emphasis was shifted to looking at the source and the germane point that something within the original investigation might have been not quite right or could have been improved was not taken.
As I think I said earlier, they are not mutually exclusive. We are doing both. I know that it feels like the emphasis was on the journalistic side, but I hope that HMICS will demonstrate that we were doing both.
It is fairly obvious that in an inquiry that goes back almost 10 years, with the number of witnesses who were interviewed way back then, it will take a long time for someone to understand exactly the complexities of the case and the lines of inquiry that need to be followed.
I need to be careful about straying into something that may well end up in a court procedure at a later stage.
Do you have any concern that the misinterpretation was wilful, given that we are considering action point 1, which says that the processes should be carried out by people who are independent of the investigation? That is the nub of the issue.
No, I do not have any such concern. The release from IOCCO suggests to us that people were “reckless”, but that the act was not “wilful”. I take some—but little—comfort from the fact that the act was not deliberate. We take that on board and I totally understand it, but from what I have seen—I am now straying into what the IPT might determine—I can say that nobody acted deliberately and that the people involved honestly believed that what they were doing was correct. I would go as far as to say that if they were to be in the situation again they would consider it differently.
We are back to the balance. The action was reckless in that people pursued the journalistic source more than they considered the criticisms about the original investigation. To have been wilful would have meant that they would have deliberately gone down that route and deliberately not considered the criticisms of the investigation.
That is undefined, to be honest. Sir Stanley Burnton, the interception of communications commissioner, could tell us why he suggested that it was reckless. I will not speculate on the interpretation of that word, but IOCCO has said clearly that it believes that the action was reckless. It has all the material that I have spoken about and has considered it all. IOCCO did not pull any punches in what it said to us.
I will turn back to the preparation for IOCCO’s visit on 15 June. As we know, it intimated on 23 March that it would carry out an inspection. You referred to the importance of Sir Paul Kennedy’s work. In his report of 4 February 2015, the first recommendation in paragraph 8.9 on page 37 is:
“Judicial authorisation must be obtained in cases where communications data is sought to determine the source of journalistic information.”
That was a key part of the report, although there might be issues with training.
There was the teleconference on 6 May, but what preparation was undertaken prior to IOCCO’s visit? Given the importance of the recommendation, judicial authorisation would surely have been uppermost in that preparation.
IOCCO tells us that it is coming to inspect and then decides what it will do. It tells us what it will consider and who it wants to interview and we ensure that that is all available to it. It goes into whatever authorisations and applications it wants to see; we do not dictate that in any way. The preparations that we can do for inspection are therefore fairly limited. That is absolutely right. As you would expect, IOCCO comes in and gets access to whatever material it wants to access, so our preparation would be fairly limited and would be about ensuring that the people that IOCCO wants to interview are available to its inspectors, and that they can get on to our systems. They then go and trawl whatever they want to trawl.
Our understanding is that, in the future, we will flag up applications such as the one that we are talking about to IOCCO at the beginning of the inspection. That is part of the new regime.
I am having trouble with the fact that the first time that the problem was recognised was in early July, following the IOCCO report. It seems to me that the issue would have been at the forefront before that inspection, in the middle of June at the latest.
Unfortunately, people believed that they had done the right thing until the inspectors came in and we were told categorically that they had not done the right thing. At the end of an inspection, the inspectors give verbal feedback about what they have found and commit it all to writing later. They visit the force and give an overview of what we have done and what we ought to do, and they make recommendations. We understood that there was an issue. As the organisation got more information, I was asked to review the matter in its entirety and to come up with recommendations as to how we would prevent it from happening again.
Thank you very much for attending, ACC Nicolson.
As we agreed earlier, we will now move into private session, so I ask everybody in the gallery to leave.
11:10 Meeting continued in private until 12:57.