We now move to evidence on interception of communications by Police Scotland, which follows a statement from the Interception of Communications Commissioner’s Office on 25 November that confirmed that Police Scotland had contravened the “Acquisition and Disclosure of Communications Data Code of Practice”. I will let the witnesses settle in. We are being swift, as we have a large agenda.
I welcome our first panel of witnesses. Deputy Chief Constable Neil Richardson is designated deputy for the chief constable at Police Scotland, and John Foley is the chief executive of the Scottish Police Authority. I thank you both for making yourselves available at short notice.
We go straight to questions from members.
Good morning, gentlemen. I am interested in the history of the matter prior to the publication of the code of practice in March 2015. I understand that, in October 2014, the then commissioner was asked to launch an inquiry and then to make an additional report to the Prime Minister about various matters relating to protection of journalistic sources because there were concerns about that, and to allegations that the police had misused their powers under chapter 2 of part 1 of the Regulation of Investigatory Powers Act 2000. A report was published in February 2015 that covered a three-year period prior to that in which it was indicated that 19 police forces had sought communications data in relation to 34 investigations into suspected illicit relationships between public officials and journalists. Was Police Scotland one of those 19 police forces? What was the practice prior to March 2015 in relation to such matters?
The reality is that the whole set of arrangements for authorising activity in that arena is subject to on-going guidance and annual checks by IOCCO and by the Office of Surveillance Commissioners, on the other side of the business. They rigorously ensure that procedures are followed and adhered to.
On the specific type of authorisation that is being referred to, in the three years from 2011 Police Scotland and the legacy constituent elements of Police Scotland progressed 12 requests that related to such activity. The five that are subject to the arrangements that led to my attending today’s meeting to answer questions are included in those 12. Of the seven other applications, one was rejected, four related to legacy force arrangements, and two related to Police Scotland. Crucially, all seven of those were subject to the normal scrutiny arrangements at that time, and were all found to be acceptable and within the guidance and appropriate standards at that point.
I am a wee bit confused about one matter. You talked about five requests that are subject to the arrangements that led to your attending this meeting. The report was published in February 2015, before the code of practice, and it refers to 19 forces and 34 investigations. I am not quite sure from the chronology how that can include the five requests. Surely it includes the seven other requests.
I am sorry, but I do not have access to the specific report that you are referring to and therefore cannot correlate the two. In readiness for coming to the meeting, I looked at the number that related specifically to Scotland, and I am telling the committee what I believe to be the accurate position in respect of the 12 requests. I cannot speak for the rest of the United Kingdom in relation to the 19 requests.
Will you talk us through how you approached the five requests—leave aside the other seven for the moment—prior to the publication of the code of practice in March?
Absolutely. As you would expect, there is a rigorous set of arrangements to ensure that standards are complied with and that checks and balances are in place. If there is a reason to progress a request for authorisation, it must first fulfil the criteria to ensure that it is proportionate, lawful and necessary. Those are not just throwaway terms; they are specific terms that are part of the gatekeeping process to ensure legitimate authorisation.
Once the request has satisfied the criteria in the applicant’s eyes, it is subject to a series of further checks involving people who are trained and specifically deployed in the organisation to offer their expertise and give a view on the matter. That goes up to and includes final authorisation.
The change that has come in as a consequence of the review that you highlight is a specific adjustment that relates to protected organisations or professions, which include journalism. That was a significant shift in practice and, on the back of it and the commissioner’s report, we have put in place further checks and balances to ensure that the degrees of rigour and scrutiny are even higher.
Were the seven requests authorised by an independent officer who was not involved in any inquiry?
That would depend on the required level of authorisation: of course, the more significant the level of intrusion, the higher the authorisation that is required. Lower-level authorisation, such as a subscriber check, might sit at inspector level. Previously, such an application could have been handled within the department that applied. However, the process has changed and that cannot happen; there is no instance in which a department or unit can authorise activity on its own request.
How much information do you have on the four requests that relate to legacy forces, and what happened with them?
I have very little such information. However, in effect, there was national practice and there was very little latitude for individual forces to have their own practices. Forces would take a general approach that was in line with what I have described. The important point is that all those requests have been examined annually under the normal scrutiny arrangements and found to be within the guidance. Appropriate standards of assurance were associated with each.
When the code of practice was published, what steps did Police Scotland take to familiarise itself with it in order to review its practice?
I think that it is on public record that the pace at which the guidance came into being was very aggressive. There is no doubt that that led to a more pressured introduction of the guidelines and, as a consequence, perhaps played a part in the error that was undoubtedly made subsequently.
That said, the senior responsible officer’s job description includes a responsibility to provide a liaison function and to play a role in ensuring that the guidance that emanates from the Home Office is appropriately distributed within the force so that people are aware of the change prior to its coming into effect. There is a trail that shows that that took place: information was circulated. In the main, officers who needed to be aware of the change were aware of it.
It is probably fair to say that the communication process was not as robust as I had hoped it would be. That learning point has been picked up as a consequence of the action and, as a result, communication will henceforth be more robust and more structured. However, that is not to say that it did not happen; it happened prior to the change coming into effect but, from my perspective, it left us a little vulnerable in terms of completeness.
For the record, who was the senior responsible officer?
The SRO was Detective Superintendent Brenda Smith, who is still in place.
What actually went out to your officers on the change in the code of practice? How did it go out, and when?
The information that came from the Home Office was circulated. There are a few points to make on that. The language of the guidance was quite complicated in its own right, so it was important that it was supported by explanatory notes. A PowerPoint-type briefing pack came from the Home Office and was circulated to appropriate officers.
Training was subsequently provided, but it was not made available until after the applications that have been highlighted by the inspector. Authorisations were made prior to the provision of formal training. Sir Anthony May made the point that the compressed timeline that was associated with delivery of the guidelines undoubtedly caused pressures. The Home Office was asked on more than one occasion for access to appropriate briefing materials, but the process by which we got that information in order to disseminate it was very slow.
Do you have the timeline?
I would need to check the specific date on which the email was sent; I do not have it in front of me.
It would be useful to have the timeline and to know how the information was circulated. Was there any response from officers on receiving the information?
We have heard evidence that a plethora of emails have gone out to officers since Police Scotland began, so it might have been buried in among hundreds of emails.
I do not know how you highlighted such a significant change. It is important that we know how and when the information was imparted and when the training took place: indeed, it is important that we know everything to do with the change in the process that is key to those five particular cases. That would be very helpful for the committee.
Good morning. IOCCO undertook inspections in 2012-13. Did it voice any criticisms at that point?
I do not have access to those findings. The important thing is that the level of adherence to the guidance was acceptable. In any inspection report there is commentary and there are always areas that are mentioned for improvement and training issues. I have no doubt that the reports would have included such material on the guidance.
However, what is critical from the organisation’s point of view is that the inspector raised no particular concerns regarding compliance.
Could you ensure that the reports are shared with the committee, please?
I would need to check the availability of that information, but I am happy to have a look. If it is possible to share the reports, I will be happy to do that.
What is the accredited list of structures?
I am sorry. The accredited list?
The list that is connected with IOCCO inspections for authorisation.
I am not sure that I understand the question.
Does the term “accredited list” have any currency in what we are discussing, as far as you are aware?
I am not sure. The term is not familiar to me.
Okay.
There are people who carry specific responsibilities—I mentioned the SRO, who is one of those. If that is what you mean by an “accredited list” of people who have a key role, I understand that; I do not understand the term “accredited list”.
How many people who might have accreditation to do certain things have had that accreditation removed?
I would need to check that.
Again, can you share that information with the committee, please?
I will endeavour to do so.
Thank you. The June 2014 IOCCO inspection was the first that was undertaken for the national counter-corruption unit. What was the outcome of that?
I am sorry. Are you referring to the IOCCO inspection?
Yes.
The IOCCO inspection did not look specifically just at the CCU.
But what was the outcome with regard to the CCU?
The report determined that there were five instances in which the guidelines had not been followed. That area is crucially important. If you will forgive me, convener, I would like to—
10:00
I am a bit lost. I think that you are talking about something that happened earlier.
I am talking about June 2014. That was when the first inspection was carried out.
I am talking about the subsequent—
No. You were asked about the June 2014 one.
Right. Forgive me but I need to check the detail.
So you would not be aware of the commentary about the poor record-keeping and form standards, and the comment that the system that was used was manual rather than electronic.
That is all part of an on-going change and I have given evidence to the committee before about the reform and the necessity to understand that things cannot change overnight. There were plans to move to electronic processes, which are now in place.
You are aware of the criticisms.
I cannot recall specific criticisms, but they were part of a raft of information that led to us deciding to improve and make the adjustments in the CCU that we have made. There has been significant change in the professional standards department and the CCU environments.
Was the CCU found to have committed multiple errors, some of which were the same mistakes repeated?
Again, I cannot remember the detail of the document you are referring to. I will not challenge it. If that information is in it, you clearly have better sight of it than I do.
Would you have anticipated that you might have been asked about that, given the subject matter?
It is important to raise that kind of point. Over a number of months, a series of accusations and newspaper headlines have surfaced that build a picture that bears little resemblance to facts or reality. I know that there has been a lot of commentary about the CCU and what it has done, up to and including portraying me as some kind of archetypal villain who is playing fast and loose with the rules. The reality is very different. If you will allow me, convener, I will try to highlight what has actually happened. At the base of the five cases that are at the heart of all this—
Mr Richardson, I have a series of questions. They are fairly straightforward. A lot of them are closed questions that require a yes or no answer.
Are they to do with what happened prior to 2015?
Yes.
I am not unhappy about that. John Finnie wants to go through the background, which Roderick Campbell started, then we will move on to talk about 2015.
I understand that the multiple errors were recorded as one error because otherwise it would have looked bad. Are you aware of that?
Again, you are quoting details of a report that I do not have in front of me.
Okay. There were also suggestions that blatant breaches of the new journalistic code were uncovered. Do you have knowledge of that?
Are you referring to the new code that came in in March?
I thought that I was referring to 2014. Are you aware of any findings other that those in the report that has brought us here today that refer to shortcomings in the treatment of journalists?
I am not aware of specific breaches of the guidelines relating to journalists prior to the IOCCO report.
You talked about a timeframe. How much notice were you given of the changes?
There was a timeline. Under normal circumstances, the guidance would have involved considerable consultation and stakeholder engagement. Usually, enabling people to become familiar with the spirit of the change and what it means in application are linked to that consultation. Sir Anthony May said himself that the timeframe would not allow the extensive consultation that would normally take place, and it meant that some of the provisions were less clear than they should or would ideally have been.
I can forward to the committee the exact timelines of when the consultation started and finished. I am not saying that there was not a timeline; I am just saying that it was rather shorter than we would have liked and that that has had an impact on our ability to ensure that officers in the authorisation process fully understand the implications of the guidelines.
Would that have included information from the College of Policing?
More than likely, yes.
Are you able to say who Clark Cuzen is?
Clark Cuzen is the detective chief superintendent who heads up the CCU.
It would be helpful for us to hear from Mr Cuzen; he would have more specific knowledge of these matters.
Yes, he probably would.
Okay. I have just a couple of other questions. Did the force get downgraded by IOCCO on any standing at any point?
Not that I am aware of—although I am not sure what you mean by downgraded. Clearly, either we adhere to the guidelines and principles or we do not. Again, the most recent inspection indicated that the guidelines were not properly met on five occasions. Is that a downgrade?
In the structures that you have, you are the disciplinary authority for Police Scotland.
Yes.
Have you initiated any misconduct proceedings against anyone regarding anything that we are discussing here today?
No, I have not.
Are you the subject of any criminal misconduct proceedings?
I am not sure that I am the person to be asking about that.
But you know that the process is such that, if you were subject to such proceedings, you would be aware of it. If you are not aware of it, presumably you are not subject to such proceedings.
It is not always the case that I am aware of complaints that are made. There is due process that is gone through, and I might be made aware at some point in that process. I do not want to mislead you, but it is the SPA that has responsibility for chief officer conduct matters. I would think that your question is perhaps better directed at the SPA.
Has Police Scotland—
The SPA representative, Mr Foley, is sitting next to Mr Richardson, so perhaps he can respond.
Yes, indeed, convener. The answer to that question would be yes but not in connection with the matters that we are discussing today.
Okay. Thank you.
Mr Richardson, has Police Scotland used RIPA on any journalists in relation to identifying their sources?
Again, the important part here is that we are subjected to rigorous and detailed investigation and scrutiny by the appropriate—
It is one of those closed questions requiring a yes or a no answer.
As ever, it is never quite as simple as that when we are giving the answer. What has been highlighted is that, in every instance where an authorisation has been sought, the inspector has confirmed that that is appropriate and in line with our obligations. There are five instances where that has not been the case. Again, they all relate to the same circumstances that have led to my being asked to come along here today.
Beyond that, I think that what I am trying to say to you is that compliance is assured by a very detailed and rigorous inspection regime, which is an on-going process. The public and yourselves should take confidence from that process that our compliance is at a very high level and that, where errors are made, that is immediately acted on and surfaced in a public way to enable the public to have confidence that those very important and sensitive areas of authorisation are appropriately discharged.
But as deputy chief constable of Police Scotland, you have a responsibility for ensuring compliance, and you failed in that responsibility.
Well, I have never sought to defend a position. The inspector has given us a report following a detailed investigation indicating that there were five instances where the standard was not met. We accept that, we have acted on it and we have corrected it. Indeed, the inspector has confirmed that he is very content that the actions that have been put in place are effective and appropriate—I believe he said that they were “robust”. They will ensure that a similar failure cannot happen in the future.
I think that that is my responsibility. I cannot—I do not think that anyone in Police Scotland can—say categorically that errors will never happen, but it is important that, when they do happen, we act and try to ensure that they do not happen again.
Okay. Thank you.
Rod, is your question related to this matter?
It is a very quick question on the history. The IOCCO report that we were referring to earlier on—the one that you were not familiar with, Mr Richardson—is dated February 2015. Are you able to say who, if anyone, in Police Scotland saw that report, and who would have been charged with acting on it?
The IOCCO report dated February 2015—
Yes. It was the precursor to the code of practice coming in.
Again, we have a range of people in the organisation who deal with that activity on a day-to-day basis. I have not read that detailed report, but please do not infer from that that people in the organisation are not aware of it. I can clarify that and come back to you on it.
Okay. Thank you.
After the commissioner reported to the Prime Minister in July, there were strong rumours that Police Scotland was one of the two organisations that were not adhering to the code of practice and, in fact, were breaking the law. My question is for the SPA as well as for Police Scotland. Will you advise us what your organisations did when those allegations surfaced?
The authority was made aware that allegations were surfacing roughly in mid-July. I was certainly advised by the chief constable at that time that that was happening, and the former chair was also advised by Police Scotland. At that time, we had a view—I think that it was a correct one—that it was a statutory matter for IOCCO, because it is the body that is responsible for investigating this type of activity.
We decided to advise our authority members, which we did, and we subsequently awaited the report that IOCCO was preparing. We then invited Her Majesty’s inspectorate of constabulary for Scotland to carry out a review on behalf of the authority, and that has been accepted. HMIC met IOCCO yesterday, I believe, and we will look to finalise terms of reference in relation to the review over the next week.
I am a bit concerned about that. Police Scotland is accountable to the Scottish Police Authority, and I would have thought that, when a serious allegation is made that Police Scotland might have broken the law, the SPA would be a bit more proactive.
I understand your concern, but I must reiterate that IOCCO is the body with the statutory responsibility for such investigations, and we believed that it was necessary to allow it to carry out its statutory duties and to prepare a report. The authority will look to have a subsequent review carried out by HMICS. We do not have investigatory powers.
Did you call on anybody once you had received notice of the allegations? Did the SPA just sit on its hands and wait for others to deal with them?
No. Before the summer, authority members—and one member in particular—had discussions with Police Scotland about some earlier publications from IOCCO. As I said, I had a conversation with the chief constable in mid-July, and I had subsequent conversations as the investigation was progressing. However, we had to allow IOCCO to carry out its statutory responsibilities.
Were those formal, minuted discussions with the chief constable?
They were not minuted. My discussions with the chief constable took place on a regular basis every three or four weeks, so they were not formally recorded.
Was that the first that the SPA knew that there was an allegation about Police Scotland?
Yes.
Was it the same for Police Scotland? You had not heard any rumours before IOCCO’s report came out.
10:15
In essence, what happened was that the IOCCO inspectors came in and did their inspection on 15 June. As a consequence of that inspection, there was obviously the usual synthesis of what they had learned, after which they made us aware of potential breaches.
At that point—on 8 July—Iain Livingstone, the deputy chief for that area, and I had a conversation in which we were specifically advised of this potential series of breaches. We initiated a specific piece of work that Assistant Chief Constable Ruaraidh Nicolson was tasked to do and which generated an immediate action plan for acting on the breaches and making changes to ensure that they could not be repeated.
The action plan contained 12 recommendations, 11 of which have been fully discharged, with the final one in the process of being completed. From that, there was a series of cascade briefings and, as John Foley has mentioned, the chair of the authority and the cabinet secretary were fully briefed on 15 July.
Can we see that action plan?
I will need to confirm with colleagues whether there is anything sensitive in it.
It would be very useful to the committee, as it would highlight the things that were going wrong. I presume that they were going wrong, if you now have an action plan in place to remedy them.
It is probably wrong to say that the action plan will show you what has gone wrong, but it highlights a series of further enhancements that have been put in place to ensure that the bar is pushed to a higher level. Additional levels of checking have been built into what, as I have said, is a comprehensive action plan that the inspector has called a very robust set of arrangements.
Was the 15 June inspection unannounced?
No.
So you knew that the IOCCO inspectors were coming. What notice did you have of that?
I will need to check the formal arrangements, but there is always a lead-in to ensure that the appropriate people are available and so on.
I think it fair to point out—again, this runs contrary to some of the headlines—that some of the breaches that have been highlighted were not some kind of glaring omission. They were errors of interpretation and judgment related to some extremely skilled members of staff. However, although they undoubtedly made an error—and I am not suggesting otherwise—the inference made by some headlines that this was complete and utter neglect of the rules that were set out is not an accurate description of what happened.
But IOCCO still said that it was reckless, did it not?
There is an important context to the language. Under the guidelines, it is necessary for authorised activity that has adverse consequences for an individual to be determined in one of only two ways—as either wilful or reckless. The inspector was clear that there was no evidence to suggest any wilful element to that activity, which leaves only the reckless element.
To you and me, the word “reckless” is quite extreme, and for any member of the public who might read it would, rightly, have a level of concern associated with it. However, it is important to understand that the term “reckless” in these circumstances is defined as something that one has failed to do or which has not happened, and it was the only term other than “wilful” that could be used. It is really important for people to understand that, given that the general intuitive understanding of “reckless” is that it refers to something more extreme.
I am sorry, but where does your definition of the term “reckless” come from?
There is no set definition within the guidelines—
You are right. I am sorry, but I think that an omission is different from something that is reckless, and I think that the inspectors would have chosen their words carefully. Anyway, that is your definition.
We are talking about a case in which a murder investigation had not been undertaken properly and in which there were inquiries about who had spoken to a journalist. Surely that sort of thing would be wilful rather than reckless.
The inspector will have gone through the detail of the evidence, determined that there is no wilful element to the case and defined it as reckless. It is clear from the discussions that have taken place that, while there is no set definition of “reckless”, an interpretation has been used by the inspector to help us to understand what he means by it. However, that information is not in the public domain, which leaves us in a difficult position.
So the inspector has given you a definition of “reckless” that is not in the public domain—if I heard you properly.
I am in receipt of a document that is not in the public domain that provides more clarity.
It would be very useful to the committee if we were to see that document. It would give us more clarity.
It would. Unfortunately, I am not in a position to share it.
Who is in a position to share it?
Again, it would need to be the source, which is IOCCO.
Has IOCCO said that that document is for your eyes only?
It contains information that would potentially compromise subsequent proceedings and, as a result, it would be inappropriate to have it in the public domain.
I am a bit lost here. What is meant by subsequent proceedings?
The inspector has determined that some individuals have been adversely affected as a result of the authorisations.
But there are no live proceedings now and nothing that is sub judice.
No, but another stage of the process—the Investigatory Powers Tribunal—might take place, so we need to be cautious that we do not compromise that.
We wish to press you on this. You have given us a definition of “reckless” that the IOCCO has shared with you but is not being shared with us. We would not be doing our duty to the public and to Parliament not to see that document one way or another. When we come to discuss this later, the committee may well want to decide how to proceed with that.
I fail to understand how the definition of a word could be sub judice or could not be released to the general public. Surely dictionaries provide definitions of words. If this definition of “reckless” is different from the current understanding of the word, I do not see how it can be difficult to release it.
You said that the Home Office was slow to release information about the changes in requirements. When did both of you become aware that there were changes in the requirements? What degree of responsibility did you think that you had to ensure that those changes were complied with?
Just to rehearse what I said previously, there are arrangements in place within Police Scotland to ensure that not just this but any changes in operating arrangements—the law or policy and practice—are appropriately communicated. When there are training or other implications, they are managed.
In our case, that is the SRO’s responsibility, and the SRO has done exactly that. I am saying that the Home Office was slow. That is a consequence of the compressed timeline for drawing up and implementing the guidelines. I am quite certain that the Home Office was under pressure to develop those guidelines. It is just a consequence of the whole picture.
Has the SPA seen the document that defines “reckless” and so on?
No, we have not seen the document. Our understanding of the legislation, which we have had confirmed by the commissioner, is that the commissioner deals solely with chief constables. That is where the relationship lies throughout the UK. Therefore, we will seek assurance from the incoming chief constable, Philip Gormley, that the SPA will have sight of that document once he is in post. We will review it at that point.
We have asked HMICS to carry out a review, too, but we will be making our own determinations once we have sight of the document. The commissioner is not in a position to share it with the authority.
HMICS must get sight of this so-called document that defines “reckless” if it is doing an inspection. Is that correct?
I would imagine so.
So it is being shared with other people—it is being shared with HMICS and, eventually, with the SPA. I do not see why it cannot be shared with a parliamentary committee, so we will pursue this matter.
I understand Mr Richardson’s desire to minimise the damage of the language, but the terms “wilful” and “reckless” have been used because the breaches of privacy in this area have been so significant.
I will return to the SPA’s comments. You said that, after learning in mid-July of the concerns, you did nothing for four months. In your conversations with the chief constable, did you not discuss what arrangements were being put in place to prevent further breaches during that time?
No, that is not quite accurate. An authority member raised the matter at our August board meeting with the chief constable and asked for comment, but the response was that it was subject to an on-going investigation, which would be reported back in due course.
Would it not have been appropriate for you or the board members to set aside that particular investigation, to say that the matter raised general issues for Police Scotland and to ask what the chief constable was doing about that?
Given that that was the first time we had encountered such a situation, we had to determine exactly what our powers and the powers of the commissioner were. Based on that we decided that we would wait for the commissioner’s investigation and his findings and, at that point, regardless of the outcome, we would ask HMICS to carry out a review. We also wanted to have a copy of the report so that we could make our own determinations on it.
The legislation would appear to suggest, as I have said, that the commissioner deals solely with chief constables. It is then up to the chief constable to determine whether he or she releases that information to an authority or the commissioner. I do not envisage our chief constable saying, “No, we’re not going to share it with you.” However, if that were ever the case, we would have to look at the matter in a different light.
Mr Richardson, in response to Mr Finnie you said that no officers from Police Scotland’s counter-corruption unit were going through misconduct proceedings as a result of breaching the code. Is that correct?
At this stage, that is correct.
Short of any misconduct proceedings, what have you done to establish why the breaches occurred in this instance? You said that all five breaches related to one case.
Yes. Again, the context is critical. Basically, what we are dealing with is information that breached out of a live murder inquiry. That was very concerning and could have compromised the flow of justice and the inquiry, so it would have been neglect of duty had we not taken steps to do something about it.
The information was first identified and surfaced by officers involved in the murder inquiry. They referred that to the CCU. The unit was in effect asked to do a piece of work to determine the problem and whether someone in the murder inquiry had broken the law. That approach was in line with CCU responsibilities—it is how it operates; that is what it does.
As part of the investigation, the CCU proposed a course of action that included the authorisations that are now subject to the concerns. It did not self-direct; rather, the authorisations were passed to another part of the business, to go through the appropriate checking process associated with the guidelines and authorisation. The officer at the more significant authorisation level did a significant piece of work and tried to apply the new regulations as he understood them. He is a very experienced officer, who has been involved in this business for more than a decade and has signed off more than 2,500 authorisations in various ways. He is also part of a department that has been commended for the past two years by the Office of Surveillance Commissioners during its annual inspections. The officer tried his level best to apply the regulations and what was required of him. In so doing, he misinterpreted the requirement and allowed the authorisations to go ahead, which was then subsequently identified by the inspectors as being wrong.
That is the reality of what has happened. The CCU people were simply trying to take forward a requirement that came from another part of the business and was authorised in another part of the business, so the notion that the CCU is running amok doing inappropriate actions is simply not accurate.
10:30
I have not made any suggestion that anybody is running amok. Can you tell us the rank and position of the person who signed off the authorisations?
There were five authorisations, asking for different types of activity. The three more significant pieces of activity were signed off by a detective superintendent; that is the individual that I have been referring to. The two authorisations of lower significance were signed off by a detective inspector.
Earlier, you said that the checks and balances and the sign-offs were outwith the CCU, but the findings were that two of them were within the organisation.
That is correct. That process is a part of the action plan that has now changed, but it was a detective inspector within the CCU who signed off the lower two authorisations. Again, I stress that that was a practice that was acceptable and which had previously been looked at by the inspectors, who had raised no issues about it. However, in relation to the most recent inspection, we have raised the bar and made it more significant by ensuring that there is now no possibility that there can be any internal authorisations; they will now all be independent and external.
You have said that the issue related to a murder case.
Yes.
It would therefore have been of some significance and some concern among senior members of the organisation, surely, that you perhaps had someone who was leaking information. Is that right?
That is correct.
So who within the senior management of the police knew about it, and why were you not extra careful about sign-offs, given that it was such an important case?
The suggestion that we have not been careful is not accurate. What I have described is a rigorous and robust set of arrangements, which were applied in this instance. It just so happens that the officer concerned misinterpreted brand new legislation that was 22 days old at the point when he was asked to do that, and there had been only a rapid introduction to that legislation, with limited opportunity for training. He himself had had documentation to read but had not received the training course associated with the new guidelines and the change. I do not seek to minimise the situation. A mistake was made, but the context of the mistake is important. The officer concerned was trying his best to do his professional duty and made an error of judgment.
I think that you do seek to minimise it, but we have to rely on what the commissioner has said, which was that it was not proportionate, lawful or necessary and that it was therefore “reckless”. That is what the ruling concluded. If your officer was aware that there were new guidelines but he was not completely au fait with them, would you not have expected him to pause and consider that, particularly given that it related to journalists’ sources?
I have taken time to speak to the individual concerned and I have read all the associated documentation, and I am comfortable that he did take a pause and try to do his level best to ensure that the guidelines on the change had been applied. He has a considerable background and credibility in authorisation activity, which has been recognised, as I said, in two successive years by the OSC. This is not an officer who has simply thrown caution to the wind and neglected his duties; nothing could be further from the truth. What he has done is to make a misjudgment with regard to 22-day-old legislation, which led to the inspectors finding that he authorised activity that should not have been authorised in that way.
This is the detective superintendent that we are talking about, is it not?
Yes.
What is his name again?
David Donaldson.
You have made quite a lot of the fact that the legislation and the guidelines were new, but it was high-profile legislation, because it resulted from concerns about accessing journalists’ sources, so there was a lot of public awareness of the new guidelines. Obviously, it was Westminster legislation, but I am surprised that Police Scotland did not manage to implement it thoroughly when many other police forces did. Can I turn to—
Before you do that, Alison, I would like to ask something. Was Detective Superintendent Donaldson in any way involved in the murder inquiry?
No.
He was completely independent of it.
Yes.
Did Detective Superintendent Donaldson seek advice from his senior officers, or did he make the ruling on his own?
I would need to clarify that point. We are talking about the force experts; in normal course, they are the people who would advise senior officers. The level of technical expertise that is associated with this area of business is extremely high. It is a technical and complicated area, and the stakes are extremely high. That is why we treat it so seriously and why there is such a high level of checks and balances.
I simply cannot accept your point about implied neglect in relation to practice. It was not neglect. What happened was a misinterpretation of new legislation.
The checks and balances clearly did not work. The law was breached because judicial approval was not sought. Has Police Scotland sought judicial approval for any other applications relating to journalism since the new rules came in in March?
No.
I will press you a little on that point, DCC Richardson. The IOCCO report says that the two applications had been approved by designated persons who were not independent of the investigations. Is a conflict of interest test not always required for internal investigations, or, indeed, any investigation?
I return to the fact that we have now changed how we work. We have introduced a level of complete independence. Prior to doing that, what happened was accepted practice. That was how business was conducted. That practice was inspected and found to be acceptable by the regulators. That will not be unique to Police Scotland; that will be the case across the UK.
On the back of this learning experience, we have pushed the bar yet higher, which I hope will ensure a higher level of comfort. However, previously that was how business was done.
In terms of the level of authorisation, we are talking about a subscriber check.
Will you explain what that is exactly?
If, for the sake of argument, somebody in Police Scotland has a mobile telephone that we know has contacted a number of telephone numbers, a subscriber check would be to see who those telephone numbers belong to. That is a subscriber check. The two authorisations that we are referring to are examples of trying to identify who owns a known number.
If anything, that fills me with more apprehension. It seems to me that in an investigation in any organisation, especially if it is internal, right at the top should be the question of whether there is any possible conflict of interest. I would have thought that it was just good practice to do that, before looking at smoke and mirrors regarding 22-day-old code of practice guidelines that somehow someone could not interpret. Is that not fair comment?
I return to the point that that was the practice. That was how the business was conducted, and it has now changed.
Well, that explains a lot.
Can we go back a wee minute? This is the detective inspector level. You called it a lower-level subscriber check. Were the investigating officers involved in the murder case in any way?
They were not involved in the murder case.
If they were not involved, how can the IOCCO say that there was a conflict of interest? Where does that come into this? How can it say that investigating officers were connected to the case if they were not at all? Were the DIs who permitted the subscriber checks not in any way connected to the reopened investigation into the murder?
As I have described, in the progress of investigating a category A live murder case, the officers involved identified that a potential breach might have taken place in which information that should have been contained within that environment had been made available outwith it. The officers raised the issue and referred it to a separate part of the business—the CCU, which effectively takes care of a range of things including, in this instance, internal investigations of criminality. That unit was charged with and was progressing that inquiry to try to find out where the breach in the murder team had taken place, and the DI whom we are talking about just now was part of that CCU activity.
Ah. Now that we have had DS Donaldson’s name, can we, in fairness, have that person’s name, too? [Interruption.]
Forgive me—I will come back to you on that.
Thank you very much.
To go back to the statutory tests of necessity and proportionality, can you tell me why the activity was thought to be necessary and proportionate? After all, the contraventions were found to be such that they have been termed “reckless”, albeit that I bear in mind your definition of that term.
The issue relates to information that was given to a journalist. It was understood that the breach happened in a murder inquiry and was presumed to have emanated from a serving police officer. The operating view was that the information had been provided to someone outside the organisation who was a retired police officer, and at some stage subsequent to that, it is clear that it was given to a journalist, because it ended up in the newspapers.
The initial focus of our consideration was not on identifying a particular journalist but on finding out who in the murder team had breached their responsibilities. That focus was quite narrow. Under the guidelines, as the inspectors have subsequently identified, if it becomes clear at any stage that we are talking about a journalist’s source, that issue must be taken into account. That is the fundamental difference.
As far as proportionality and necessity are concerned, the issue was considered and the approach was deemed to be at the right level, but it was felt that the consideration had taken too narrow a focus when it became clear that the information was with a journalist. That was what the inspectors highlighted, and it led to the inevitable conclusion that the activity was either wilful or reckless—and, given that it was not wilful, it had to be reckless.
In other words, there was a breach of article 10 of the European convention on human rights, which relates to freedom of expression. In focusing not just on the person who leaked the information, you did not take into account everyone else who might have been affected.
That is ultimately the substance of the new regulations. Articles 8 and 10 are our core considerations, and the new guidelines indicate that protected professions need to be far closer to the front of our thinking. That is where the misjudgment took place.
In response to our quite reasonable questions, you have continually referred to newspaper headlines. You seem to feel quite a lot of resentment about them. Did that cloud your judgment and lead to the breach of article 10, on freedom of expression?
No. I am trying to explain the context—
I understand all that. I have the context, and what was overlooked was article 10 and the fact that what you were doing might have involved identifying a journalist, even though you were clearly focusing on an individual who had leaked information. You did not take into account the effect that there might be on freedom of expression under article 10, which would affect journalists. I say that because, on a number of occasions today, you have had a go at the press.
10:45
I am suggesting that the journalistic element was separate in the initial thinking and consideration—or rather, that it was not separate but was so far removed or distant that the consideration was in a different place. That has subsequently been found to be incorrect, and changes have therefore taken place to ensure that that does not happen again.
I am not suggesting that we have somehow been neglectful or been driven by concerns about headlines; I am simply saying that, as the situation has played out, there has been a continued series of headlines, and that because they appeared while the investigation was on-going, we could not provide any context or commentary. That has in a sense fuelled the concern and led to a situation in which I am sure that the public are being led to believe that there are levels of activity associated with this area that have not actually happened.
I think that we have got all that. I am coming to the issue only now, from looking at the papers. If I were looking at the papers and being asked to implement such a change, two things would be crystal clear to me. First, I would have to look at the source of the information, and secondly, I would have to look at the possible collateral damage—at who else would be affected whom we did not intend to pursue. There seems to have been huge neglect that was at least reckless, if not wilful.
I will bring in Margaret McDougall next, as she has not been in yet, followed by Gil Paterson, John Finnie and Rod Campbell.
And me too—I asked to come in at the start.
I beg your pardon. I will bring you in after Margaret McDougall. You were not on my list—we are slipping up a little.
Good morning. Who in Police Scotland was responsible for ensuring that the designated persons to whom the IOCCO report refers were made aware of the new code of practice and the requirement to seek judicial approval?
That is the senior responsible officer, Detective Superintendent Brenda Smith, whom I have mentioned previously. She is the liaison point and acts as a conduit with the Home Office for information.
Did Detective Superintendent Donaldson seek advice from the SRO?
There would have been communication, because the SRO forwarded information. As I said, I would need to check with David Donaldson exactly whom he spoke to, but he is the force expert and the person who would advise others. I would expect him to read the guidance and the legislation and to determine, by using his experience, exactly what that meant for practice.
For my sake, because I am not into all this technical jargon, will you say what “judicial approval” means?
It means that an application has to be looked at and considered by a judge.
Is that clear in the code of practice?
I am not sure that I understand. The code of practice—
The code of practice says that judicial approval is required.
Yes, but as I explained, what happened with the five breaches was that active and fulsome consideration was given. The line that the officer took was that journalists were not involved or were so far removed from the matter that judicial approval was not required as set out in the guidelines. As a consequence, he felt—erroneously, it now appears—that it was acceptable for him to authorise the activity without that step being taken. The IOCCO report highlighted that that was an error of judgment and that he should have considered the source as being journalistic, so the activity should have gone through the process of judicial approval being sought. That is exactly the heart of the issue.
It seems clear to me as a layperson that, as you said, there was an intercept of communication that you presume was between a member of the police force and a journalist, but that was not clear to Detective Superintendent Donaldson.
It was not. As I said, there was a breach during a murder inquiry from a police officer to a retired police officer, and the focus was on the serving officer in the murder squad, so the journalist was further down the stream. The initial consideration therefore formed the view that the requirement for judicial approval did not apply. That has subsequently been highlighted as incorrect, but that was the judgment that was reached at the time by an experienced individual who did his best to apply the changed legislation to the circumstances that were presented and to form a view.
The fact that the information finished up in the papers means that it must have got to a journalist, but that did not occur to the detective superintendent.
Clearly it did not. That has now been taken account of. The inspector has said that it needs to be taken account of, and we have taken the necessary steps.
What training was Detective Superintendent Donaldson given? It seems that he had no training and that he only had the legislation in front of him. To me, it says clearly that judicial approval is required, but he did not pick that up and he thought that, although the information was in the papers, no journalists were involved.
Are you referring to what training the officer had specifically on the guidelines or in general?
What training did he have on the code of practice, as an expert?
As I mentioned, he received training, but that was after the authorisation was sought and given. Before that, he received the guidelines, as I highlighted, which came via the SRO. That was written documentation; there was also a presentation. He had to interpret that, which he did, to inform his decision-making process, and on this occasion he misjudged that.
Good morning, gentlemen. I will go back to the timeline and check with you what you have just said. You said that the change in the law was enacted on 25 March and that the CCU made the request 22 days later. You have said repeatedly that, between that time and 15 June, the person in charge received some training. Alarm bells must have been ringing at that point that what had been done was unlawful and was not permissible under the new legislation. What happened between the time when he got the clarification and the training and it was clear that what he had just done was not lawful, and the time when IOCCO started the investigation?
As I said, there was active consideration by the officer, and he was content at that time—and subsequently—that his judgment was accurate. The training did not adjust that position. When the inspection took place on 15 June, the authorisations were picked up on, and subsequently there were conversations. Up to that point, the authorising officer was comfortable that his decision was appropriate.
Then something has to be wrong, because you said early on that the officer could not have known the position when he took the action because he did not receive proper training. However, the training took place before IOCCO became involved, so he should have realised his mistake. If he was unable to determine that he had made a mistake, his having training—whether that took place before or after he took the decision—was pointless.
I repeat that the issue is not straightforward and is hugely technical. In effect, Sir Anthony May has conceded that the guidance—even within the training—could have been clearer. As a consequence, notwithstanding the training, the detective superintendent that we are talking about had applied a rationale and an approach to his decision making that he believed was in line with the guidance and was correct.
The inspector’s view was different. We accept that view and we have taken action accordingly. However, at the time, the officer was doing his level best to live within the changes and the law and to do his job. It has been subsequently determined that his decision clearly was not correct.
Is it logical that, even though the officer had received appropriate training and all the guidance was made available when he made the decision, he did not flag up the matter?
I am saying that the officer was trying to do his job and that he was applying an approach that he thought was correct. It is not appropriate to use hindsight to suggest that he should have known things.
I am just asking how much guidance and training is needed before one understands that a mistake has been made.
As ever, reading a direction—particularly on matters of law that are at times incredibly complicated—is not enough. It has been acknowledged by all parties that it is through the engagement and the consultation that usually take place in the lead-up to a change that people understand and have an opportunity to engage and test their thinking. On this occasion—for various reasons, including time pressures—that did not happen to the extent that it should have done. That led to a position where people were not as familiar with the spirit of the guidance as they perhaps should have been.
I am rehearsing the same answers.
We are trying to understand when the officer got the training. If it was available before June, he would have had at least one or two months to justify what he had done. You said that the timeline was too short for officers to understand what the legislation required, but you did not give us a timeline. Why do you think—
Christian, I have asked for a detailed timeline.
Was the period before the legislation was enacted long enough for training to take place and for you to be confident that officers would have the time to take it on board? Should that period be a matter of months or a year?
It is impossible to answer such a question. Ultimately, appropriate consultation needs to take place to give people an opportunity to engage. In this case, the detective superintendent went on a training course on 6 May. That date was some considerable time after the guidelines were put in place and was after a point when he had been asked to take a decision on authorisations. That clearly was not a satisfactory situation.
Was the period between 6 May and 15 June not long enough for the officer to flag up an issue?
I am sorry, but that is not a question about training.
I think that we will move on, if you do not mind, Christian.
I would like to keep going, if you do not mind, convener.
Let us first hear what you wish to raise.
We have talked about training. I will go back to a letter that was sent to Mr Foley by Mr Anwar. Do you want to comment on that?
I have received a letter from Mr Anwar. It would not be appropriate to discuss that this morning. That is a legal situation and Mr Anwar is a solicitor.
You received that letter.
Yes.
We have the letter, too.
We have the letter as well.
We know what is in it, so I would be happy for Mr Foley to respond.
Mr Anwar is representing clients, and I will consider his letter. I have yet to respond to him. I will need to review the contents of his letter, carry out a review and then respond to him. It would not be appropriate to comment at the committee prior to having formulated a reply to him.
11:00
I remind members that we have not replied yet. We have yet to discuss what we will do with that letter.
May I ask a final question?
Yes. You are holding back Gil Paterson, but that is not my problem. You are sitting next to him.
Deputy Chief Constable Richardson said earlier that he thought that, with the reopening of the murder inquiry, the leak from an officer to a journalist could be a breach of the law, so it should be investigated. Will the new arrangements and the change in the legislation stop Police Scotland doing such investigations?
No. Ultimately, we are duty bound to investigate any serious criminality and, if we believe that a crime has taken place, we will investigate it. I suppose that the issue in relation to the guidelines is the manner and seniority of the authorisations. There is nothing in the guidelines that dictates that we cannot now take the necessary steps to investigate anything that requires to be investigated. We just have to go through further checks and balances to ensure that the investigation is completely compliant and in line with the law.
Do you think that, if you had made a request, it would have been approved?
Come on—let us move on. I know that those who have spoken are itching to ask short supplementaries, but I will allow Gil Paterson to speak for the first time.
My questions will be supplementaries, as most of the stuff has been covered by my good friend Christian Allard. I elbowed him; you probably did not spot that.
Elbow him in French next time.
Deputy Chief Constable Richardson, who or what was responsible for pushing the timeline? Did that happen because the matter was in legislation or was there another pressure to get things going?
I honestly do not know the answer to that question. The matter is reserved. There will have been a series of pressures, but I am honestly not in a position to answer that question.
You said that you thought that matters were rushed. Could Police Scotland have asked for more time so that training could have taken place? Were you pushed to rush because the matter is now in legislation?
No. I do not think that Police Scotland could have done anything to adjust the general position. We are talking about national change. Police Scotland asked questions about information to enable training to take place, for example, but I am not criticising. I know that a number of colleagues, including colleagues from the Home Office, were under pressure, and nobody was being deliberately obstructive. Things were just rather pressured for all concerned. I think that that has been well recognised by the various parties, including Sir Anthony May.
Does that notion of pressure come with hindsight, because of what happened, or was the envelope too short?
The matter is fairly clear when we look at it now; it is more stark when we look at it with hindsight. Being on a training course several weeks after the guidelines have been implemented is far from ideal. Ideally, the course would have ensured that an appropriate lead-in took place and that individuals were trained and ready to properly apply the guidelines prior to their going live. However, we do not live in an ideal world, I suppose, and that certainly did not happen.
What if that time had been available? I note that you said that the issue is very complicated. Could what happened still have happened because of the complications, or is that too much to ask you to answer?
It could still have happened. The reality is that this is an issue of interpretation and application. The officer concerned has never sought to avoid the criticism; in effect, he has acknowledged that there was an error on his part. Without rehearsing what I have already said, I believe that the officer was trying his level best to do his job and apply the regulations, but he just made a mistake.
You might have already said this but I do not know that I understood the answer. When did Police Scotland take remedial action?
After the inspection, there was a period for pulling together the report. We were advised on or around 8 July. Iain Livingstone and I had a conversation on that day and we tasked Ruaraidh Nicolson with a piece of work that led to 12 recommendations being made, some immediate measures to ensure that there was a separation and that a deputy chief constable was involved in the process around articles 8 and 10, and a number of other measures. Of those 12 recommendations, 11 are now fully discharged and work on one, which relates to the judicial processes, is currently under way.
Thank you.
Mr Richardson, you were aware of the publicity and concerned that it would compromise a live murder inquiry. What did you do?
With regard to the publicity?
Yes.
Well, a series of requests were made for comments on the circumstances and we were unable to comment on the circumstances, largely because the inspection report had not been published. A half-yearly report came out from my—
No, sorry. You said earlier that you were concerned about the publicity around the conduct of a live murder inquiry.
Yes.
What did you do about it?
As I say, there was a referral from the murder team to the CCU and there were—
Did you speak to the murder team?
No. I would not routinely do that. We have mechanisms in the organisation. Iain Livingstone and I had a conversation about the circumstances and the CCU was charged with doing a piece of work to find out what the issues were.
Did you speak to the CCU?
I speak to the CCU regularly. It works under my—
No. Mr Richardson, is it your position that, while you were aware of the situation, it was left to a detective inspector to initiate everything that has resulted in us having this discussion today? Did you have personal and direct knowledge of what was happening as a result of that publicity and the action taken by some of your subordinates?
I was clearly aware of what was happening. The organisation has checks and balances, which I am describing to you, to ensure that rules and processes are followed. They were initiated.
If I was to jump in, that would present a risk in its own right. I did not do that in this instance.
So what were you aware of?
At what point? What do you mean? I read the headlines the same as everybody else.
Yes, and they clearly caused you concern, but like everyone else, I hope that you see that there is an important role for the press in any liberal democracy. Our job is to scrutinise and understand what you did. Were you aware that the DI had raised the issue?
I do not understand the question. The DI raised which issue?
The issue of seeking to establish the source of the information. You have told us that you were concerned about the publicity and how it might impact on a live murder inquiry.
Yes.
You also said that although you have oversight, you did not have direct involvement in how Police Scotland responded to that publicity. Is that your position?
What I am suggesting to you is that, on a day-to-day basis, the CCU is responsible for a national organisation and it conducts a range of investigations. I do not get into the detail of each of those investigations on a day-to-day basis. That is what I have a detective chief superintendent heading the unit to do. I will receive updates according to practice, and if any issues need to be brought to my attention, they are.
So when did you receive an update on the publicity?
We receive updates on publicity and media coverage on a day-to-day basis. I usually meet the CCU twice a week. There would have been routine reporting but I cannot give you a specific date for that.
Roughly when would you have heard about how Police Scotland was responding to the publicity?
Police Scotland was not responding to the publicity because it was not in a position to do so.
Clearly it was responding by seeking to establish the source.
That is an entirely separate thing.
I do not know whether I am not making myself clear here.
Here is what we are trying to get at. Newspapers are running stories that a murder case has been mishandled and that there was almost a “cover-up”. It is not just any old thing that has happened and been brought to light in the headlines; it is a high-profile murder case. You see the stories in the papers saying that there has been a bit of a cover-up about the investigation not having been handled properly. Surely you would be asking, “Who the hell’s putting this to the papers? Let’s find out.” What did you do? I would imagine that, at the time, the top of the tree would have been shaking in order to find out. I think that that is John Finnie’s point. What did you do when you saw those stories? Who did you speak to in order to find out where they were coming from?
There are two separate things here—the distinction is important. There is general coverage in relation to a murder inquiry—
No, no. We are talking about this particular case.
That is what I am talking about. Ultimately, the bit that was the focus of the referral to the CCU and then the subsequent inquiry related not to the generalities of the murder investigation and all the associated activity but to a specific concern that information had breached, from the murder team, outwith the confines of Police Scotland.
Let me stop you there. When did you become aware of that? If it means that you have to consult notes and come back to us, we would understand that, because you are clearly a busy man.
I will refer back, identify it from a timeline and include it in the follow-up correspondence that you are looking for.
As a police officer, you can understand why that is important—it is when you would have personal knowledge of the events that gave rise to us being here.
And what you did, following that, if anything.
Okay. I will come back to you on that.
I have one final point. Is criticism of any live inquiry seen as compromising that inquiry or is there a role for the press in articulating public concerns about a police inquiry?
Again, I draw a distinction between the two. The press has a role to play in making the public aware of a range of things, including a degree of scrutiny of public bodies. The press are entitled to do that; that is absolutely appropriate and acceptable. My focus would be on whether individuals within Police Scotland have broken the law and breached their responsibilities as serving officers, and I would expect that the public would demand that we address that. That is the focus here, as far as the CCU inquiry is concerned.
Yes, absolutely. I could not agree more. You will therefore understand my astonishment that the person charged with discipline in the force is unable to tell us how he responded to a matter that caused him great concern. While I welcome you coming back with your notes, I would have thought that you would have said, “I was aware that the DI did this and the CCU did that. I became aware of that, and this is where it went”, rather than—
But I think that I have already answered that.
Instead, we have had a lecture, yet again, on process. This is not about process; it is about your personal knowledge of the matter as the individual in charge.
I have answered a series of questions. Maybe I am just not understanding the questions. I have given you a candid overview of my appreciation of the matter and how it came to light. I am perhaps not reading the questions that you are asking but I think that I have answered all of them.
Let me rephrase this. There is publicity about something that could constitute a crime or misconduct. As the disciplinary authority, are you proactive on that or are you just waiting to see how things unfold? The public’s anticipation would be that you would say, “There’s something wrong here. I need to find out what’s happening.” I appreciate that you have various subordinates who will come to you with information, but it is inconceivable that you would have no involvement in the matter until we get way down the line, when someone analyses how you have gone about your processes and refers to it as being reckless.
Let us separate the media coverage entirely from this. What I have said is that, when it became apparent to the officers in the murder inquiry that something had taken place that potentially constituted a crime, they referred that to the CCU. The CCU did some assessment of that and determined that it needed to progress an inquiry.
But what did you do?
I am getting to that. The CCU, at the point when it felt that it had something that it needed to investigate, would have updated me as is normal practice. I cannot give you the date on which that happened but I can try to find out.
We have many questions that we wish to pursue. I advise the committee that our work programme will undoubtedly include a list of those questions once we have perused the Official Report and fleshed out the information.
Mr Richardson’s evidence raises three points that I want to explore further. Did you actually find the leak?
11:15
Again, I do not want to sound obstructive, but I do not think that I can comment on that, because of the potential subsequent activities of the IPT.
If you have found a leak, has the action that you might be able to take been compromised by Police Scotland’s own breaches of this legislation?
I do not believe that there is any such compromise.
I think that I am right in saying that the Emma Caldwell case collapsed in 2007, but you also mentioned a live murder inquiry. Can you give us more information about how active that was?
We categorise investigations, and the Emma Caldwell inquiry, as a category A murder, was in the highest category. As a result, the number of people associated with the inquiry was at the highest possible level.
An undetected crime at that level is never shut down; it remains live all the way through, and even when the lines of inquiry dry up, what happens over the passage of time with advances in forensic opportunities and other things is that constant reviews take place to find out whether any new lines of inquiry might have emerged to enable further progress to be made. As far as this set of circumstances is concerned, the inquiry has remained live, and reviews have taken place systematically. On 25 May, the Lord Advocate instructed that it be escalated to a full category A approach and, as a result, appropriate resourcing was put around it. That is the chronology and the sequence of events.
I am sorry, but if it was already a category A case, how could it be raised any higher?
It might remain a live category A inquiry, but once the lines of inquiry dry up, it goes into the ownership of a team that carries out the constant reviews. If something is found during a review or if, as in this instance, the Lord Advocate says that he wants things to be taken to the next level, we take the case back out of the unit that deals with reviews and resource it accordingly to ensure that more assets are available for hands-on work.
Were you investigating what you thought was a leak after or prior to the Lord Advocate’s instruction that resources be put into the case? Was it still in the review process that it had been in since 2007?
I am sorry—I will need to check that and come back to you.
It would be great if you could.
If you will indulge me, convener, I want to ask a final question. Deputy Chief Constable Richardson, you said earlier that only a subscriber check was carried out. Am I right in thinking that such a check applies only to phone records, time and location—in other words, to whom people are talking, where they were when they were talking and how often they were talking?
No. A subscriber check relates only to the details—the owner and so on—of a telephone number. No additional information such as whom the person is speaking to is provided.
But you would know how often the other person was contacted.
No. A subscriber check is simply about the person to whom the telephone belongs.
Thank you.
Can we see the letter from the PF? Is that in the public domain, too?
The PF? Do you mean the Lord Advocate?
I am talking about the letter of 25 May, asking you to escalate the murder inquiry.
I did not mention a letter—I simply said that the Lord Advocate had asked that things be escalated. There might well be a letter, but I am honestly not sure about that. I would need to check.
It would be useful to know what, apart from various other things, prompted the Lord Advocate to take that decision and whether it was the press reports, and not just the usual review of unsolved cases, that led to the case coming back into the system and the police looking at it again.
Rod Campbell will ask the final questions.
I have a couple of points. First, on the question of judicial authorisation, the code of practice sets out requirements for applications for communications data to determine journalistic sources and highlights in three bullet points information that could be
“considered to determine journalistic sources”
including
“data relating to ... journalists’ communications addresses; ... the communications addresses of those persons suspected to be a source; ... and communications addresses of persons suspected to be acting as intermediaries between the journalist and the suspected source.”
It seems that quite a lot of detail is available to you. Are you still saying that DS Donaldson gave full regard to that?
I can say only what I have said already: as far as I am concerned, DS Donaldson gave appropriate consideration as he saw fit to doing his job and adhering to the guidelines. It has subsequently been determined that that was incomplete and incorrect. I cannot say any more.
No, but perhaps DS Donaldson can.
Can we put into context the question of requiring judicial authorisation? Was this only a one-off or are there other forms of application—not necessarily for this sort of thing—that would require judicial authorisation and with which DS Donaldson might have been familiar?
I am not sure that I understand what you are asking me.
Basically, would DS Donaldson be used to getting judicial authorisation for applications not necessarily to determine this kind of journalistic source but for other things?
I think that he is very familiar with the rigours of authorisation that in different ways require different standards. As I have said, since this specific instance involving a journalistic or protected profession, no such requests have been made; this does not happen on a day-to-day basis. Largely, though, DS Donaldson is familiar with the necessity of applying legislation to a decision-making process. That is his profession; it is what he does. Again, in this instance, he tried his level best to do that appropriately—and the rest is history.
Okay. I will leave it there.
Thank you very much for your evidence. As I have said, the committee will consider its next steps on the matter later on today.
Given the length of that session, if members are content I will suspend the meeting until 11.30.
11:22 Meeting suspended.
Before we move to the second panel of witnesses, I suggest, given that we have taken so long—quite rightly—in questioning the first panel of witnesses, that we take item 3, on the Abusive Behaviour and Sexual Harm (Scotland) Bill, at our meeting in the first week back in January. That will give us the opportunity to have a proper attempt with real questions, because there is a lot that we want to ask about the bill. That is the best way forward, and I am advised that the cabinet secretary will be available at that time. Do members agree?
Members indicated agreement.
I welcome Michael Matheson, Cabinet Secretary for Justice, along with officials from the police division of the Scottish Government, Ian Kernohan and Graeme Waugh. Cabinet secretary, do you wish to make an opening statement?
I am happy to go straight to questions, convener.
I like the sound of that. Roderick Campbell will go first.
Good morning, cabinet secretary. Perhaps you could start by outlining the formal relationship between IOCCO and the Scottish ministers.
IOCCO is a reserved body that is accountable to and reports to the Prime Minister. Scottish ministers have no direct control over IOCCO or its functions because all of that is set out in the Regulation of Investigatory Powers Act 2000. Any reports from IOCCO regarding investigations into public bodies go directly to those public bodies, or to the Prime Minister, rather than to Scottish ministers, so Scottish ministers have no direct authority over IOCCO and how it functions.
How do you feel about that? Is that satisfactory?
There is always room for improvement, and I would certainly like improvements to be made in this area. For example, if a Scottish public body was being investigated by IOCCO, it would be reasonable for Scottish ministers to be notified so that we would be aware that such an investigation was taking place. At present, that does not happen; it would be better if Scottish ministers were automatically notified. It would also be useful, where there is a IOCCO investigation into a Scottish public body and it has completed an inspection report of that body, for the report to be provided to Scottish ministers.
The committee will be aware that the UK Government is planning to revise the 2000 act next year, part of which will involve making changes to the commissioner’s role. It is proposed that the Office of the Surveillance Commissioners and IOCCO be rolled into a single oversight commission. It would be helpful, at that point, if we had in legislation a clear line from the new commission to Scottish ministers so that it could report on any matters relating to devolved bodies that are responsible for functions under that area of reserved legislation.
I turn to IOCCO’s reports. In the previous evidence session, I referred to a February 2015 report from IOCCO. Can you help the committee by advising whether a copy of that report was supplied to the Scottish ministers? When was your first communication in relation to those matters?
We did not receive an advance copy of the report: I understand that the report went to the Home Office and that it is now available in the public domain. The report refers to the work that IOCCO undertook in October 2014, and the report was published in February 2015, which resulted in the code of practice being introduced on 25 March 2015.
Can you help the committee by telling us when you first became aware of the code of practice and, in turn, of a possible breach of it?
Is the question about both the code of practice and when it was breached?
It is potentially two questions.
We were made aware at the end of February this year by Home Office ministers that they intended to introduce a code of practice in March. I noted in some earlier exchanges that individuals referred to changes in legislation: it is worth keeping it in mind that there has been no legislative change and that it is simply a code of practice. It was introduced as a code of practice because there was no time available in Westminster to introduce legislation on the issue. My understanding is that the Home Office intends to amend the Regulation of Investigatory Powers Act 2000 to put the provisions in the code of practice into legislation so that they have a statutory footing, for future reference.
As I said, though, we were advised at the end of February that the code would be introduced in March this year. We were made aware of the breaches of the code at the beginning of July this year, and I was then formally given a briefing on the full extent of the issue by Assistant Chief Constable Nicolson in July—I think it was on 15 July.
Can you tell us about that briefing?
The briefing was primarily about what you already know. IOCCO had undertaken an inspection of Police Scotland between 15 and 17 June this year, during which it had identified breaches of the code of practice that had been introduced in March. IOCCO had relayed that information to Police Scotland, which was at that point undertaking a review as a result of the findings. That review was submitted to IOCCO at the beginning of August this year.
My primary concern was to ensure that Police Scotland was co-operating with IOCCO on the breaches that had been identified, and that the matter was being looked at in detail. Police Scotland confirmed that that was part of the review work that it was undertaking for IOCCO and that it would address the deficiencies that had resulted in the breaches occurring in the first place. Police Scotland also confirmed that once the review had been completed, it would undertake a process to establish an action plan to address the issues.
In the interim, we contacted IOCCO to ask it to confirm that Police Scotland was co-operating and working with it on the issues that it had identified—which it did—and to confirm that once the review had been completed, an appropriate action plan would be taken forward to prevent the breaches from occurring again.
You were asked in Parliament on a number of occasions to confirm whether Police Scotland was one of the forces that had been referred to IOCCO, but you refused to provide that information. Can you clarify for the committee’s benefit why you took the view that you would not provide that information?
The context of that is that Police Scotland is no different from any other police force in the UK in terms of governance and oversight of the use of the legislation for the purposes for which it is intended. It is IOCCO’s responsibility to undertake that oversight and the accountability role that goes alongside it. IOCCO identified in its interim report in mid-July that it was investigating two police forces in relation to possible breaches of the code. Understandably, that generated interest around whether Police Scotland was one of those forces.
Given that the investigation was on-going, and given that it was continuing to look into the issue, IOCCO’s view was that it would not be appropriate to name the forces that were involved. We accepted and respected IOCCO’s position. It set out in its public statement why it would not be appropriate to name the forces, on the bases of the nature of the investigation, and the potential implications that doing so could have for any further work that it was undertaking and for the individuals who may have been affected by breaches. We respected its position and came to the view that it should continue to undertake its role on the basis that it had set out: that the two forces should not be identified while it was completing its investigation.
What is the role of HMICS and the SPA in this matter?
We must distinguish between two things. My understanding is that HMICS will not undertake a review of investigatory powers because IOCCO has responsibility for and oversight of that. HMICS will be responsible for looking at the robustness of the procedures and processes around the counter-corruption unit in Police Scotland. As I said to Parliament, it will be an in-depth, thorough and independent review of the processes. The terms of reference for that review are presently being finalised by HMICS in co-ordination with IOCCO so that they do not overlap with IOCCO’s area of responsibility, and with the SPA, before the investigation’s heads of agreement are finalised.
What is the SPA’s role?
The SPA requested the investigation by HMICS. HMICS agreed to do that and will report to the SPA. As is always the case with HMICS reports, a copy will be laid in Parliament.
I will let other members in now.
It is very kind of you to tell me my place. I will now let other members in—that is you down to the bottom of the list, next time. We will have Elaine Murray followed by Gil Paterson.
When did it come to your attention that Police Scotland might have breached the new IOCCO code?
That was around 10 July. ACC Nicolson provided me with a formal Police Scotland briefing on 15 July.
What action did you take at that point?
I did what I have just set out. I sought Police Scotland’s assurance that it was complying with the investigation that IOCCO had undertaken; it confirmed that it was. It had identified why there had been deficiencies in its process. It was undertaking a review as a result of IOCCO’s findings on the issue, and that work was being taken forward over July. Police Scotland submitted the results to IOCCO at the beginning of August. That process had already started and was being taken forward.
The second thing that I was keen to ensure was that action was taken to prevent this type of thing from occurring again. That required, in part, Police Scotland to take forward an action plan to address the issue. That was progressed following the review work that Police Scotland submitted to IOCCO on its findings from its inspection.
We also contacted IOCCO to ensure that the work was being progressed. It confirmed that that was the case, that Police Scotland was co-operating with it, and that Police Scotland was undertaking an internal investigation as a result of the issues that IOCCO identified.
Have you had sight of Police Scotland’s action plan?
Yes.
Are you satisfied with it?
I am satisfied with it and IOCCO is satisfied with it. As IOCCO said in its public statement, Police Scotland has put in place a robust range of measures to prevent this type of thing from happening again. I, too, am satisfied that Police Scotland has changed its arrangements in order to prevent something like this from happening again.
When I asked the SPA what action it had taken, it appeared not to have taken any, but to have sat back and said that it was a matter for IOCCO. Were you surprised that the SPA, as the organisation that scrutinises Police Scotland, under legislation that was passed by Parliament, was not more proactive and that it did not ask any questions of Police Scotland?
11:45
My understanding is that the SPA was provided with a briefing by Police Scotland on the issue at the beginning of July, so it was aware of the initial findings of IOCCO’s review of Police Scotland’s procedures.
However, it is worth keeping it in mind that statutory responsibility for oversight lies with IOCCO. There is an issue about the SPA having oversight in an area that is outwith its control.
Equally, however, given that Police Scotland has not had a particularly easy year—a number of issues have come up—did you not expect the SPA to be a bit more concerned that, yet again, there was bad publicity surrounding Police Scotland?
I have no doubt that the SPA would have been concerned, but the point that I am making is that responsibility for oversight in this area of legislation lies with IOCCO. On such issues, the situation is exactly the same for Police Scotland as it is for any other police force or public body in Scotland. What happens in Police Scotland is no different from what happens in any other police force in the UK in this respect, in that IOCCO has responsibility for it.
However, I think that it is important that lessons can be learned from what happened. The SPA’s action in requesting HMICS to undertake a review of some of the procedures and practices in the counter-corruption unit was useful, and I fully expect that if there are any findings from the HMICS review the SPA will pursue those with Police Scotland to ensure that they are appropriately and fully implemented.
IOCCO said that the actions of Police Scotland had been “reckless”. The word is used in legislation—it is in the Abusive Behaviour and Sexual Harm (Scotland) Bill, consideration of which we are having to postpone. What do you understand the definition of the word “reckless” to be?
I suppose that you would have to put that to IOCCO, which made that determination. I believe that there are two levels of determination that IOCCO can make: it can determine that action was wilful or that it was reckless. In this case, having considered the matter, it decided that what was done was reckless. The distinction is that there was no attempt on the part of officers in Police Scotland wilfully to not apply the code, although they were reckless in failing to apply it as intended, which could have had an impact on individuals who were affected by that.
The definition of what was said in the final determination is a matter that you would have to pursue with IOCCO, given that it is its responsibility to come to such determinations.
DCC Richardson seemed to imply that the definition is in some way confidential. Does that surprise you?
Again, it would be for IOCCO to explain that to you, if it does not intend to explain how it has come to that definition. My understanding is that there is a marked difference between a determination that action was “wilful” and one that it was “reckless”, in that a determination that it was reckless indicates that there was no deliberate attempt not to apply the code. IOCCO has stated that, and Police Scotland made it clear in the statement that it made following the investigation. However, it is clear that an error was made by an officer who I have no doubt was trying to do his best. In this instance, the code was not properly applied.
There is an understanding in Scots law of what “reckless” means, because we use it in legislation. Is not that the case? Do you think that IOCCO’s definition of “reckless” is somehow not as rigorous as our definition of it?
I do not really want to pre-empt IOCCO’s explanation of its definition. You would have to pursue that with IOCCO, given that it was its definition that it used in its determination.
Good morning, cabinet secretary. We heard that some of what happened came about because there was a push for an early introduction of the code. Will you respond to that? Was the Scottish Government involved in the push for the code to be introduced more quickly?
The timeline relates to the work that was commissioned by IOCCO around the way in which the police were obtaining communications data relating to journalistic sources. That work started in October 2014 and reported—to the Home Office, I believe—in February this year. The timetable for the introduction of the code of practice was a matter for the Home Office.
Concerns were expressed about the speed at which the code was introduced—I believe that the commissioner himself, Sir Anthony May, raised some concerns about that—but I also recognise that there was a desire to make sure that the issue was addressed prior to the dissolution of the Westminster Parliament, so that arrangements were in place to deal with any requests from the police to obtain such communications data. I suspect that that was one of the biggest factors to influence the matter. That said, the speed of the process may have led to some of the challenges that have been presented.
Notwithstanding that, IOCCO has identified areas in which there were deficiencies. It is important that those are appropriately addressed and that actions are taken to prevent them from happening again.
As you pointed out, we are talking about a code of practice rather than a statutory requirement. Given that fact, could a decision have been taken in Scotland to slow down the process, or is it only because we know what has happened that we see that that was a result of the short time taken?
We could not have delayed the process in Scotland because it is a reserved area. The code of practice was taken forward by the Home Office, and it is not an area where we could have decided to take a different approach in Scotland. The approach applied to all forces across the UK and the timeframe was set by the Home Office.
So the pressures were UK-wide.
All forces across the UK are covered by the legislation. We were not in a position to say that it would not apply in Scotland, because the area is outwith our competence.
Has IOCCO investigated any other Scottish public bodies either this year or in previous years? If so, how many? I know that there may be limitations in your knowledge because it is a reserved area.
I am not aware of any. IOCCO undertakes an annual review of public bodies that have powers under the Regulation of Investigatory Powers Act 2000, and I am not aware of findings against any other public body on these matters. I would expect any inspection process always to find areas in which bodies can make improvements, but IOCCO has not flagged up to the Scottish ministers concerns about how any public body is applying RIPA or its guidance.
Having said that, and going back to my earlier comment, I do not think that IOCCO would normally notify us of such matters anyway, because they are reserved—it would not necessarily direct any information to the Scottish ministers about such incidents in the first place.
Even although the matters are reserved, would it not be common courtesy to inform the Scottish ministers—not so that you would take any action, but just to keep you posted? Alternatively, are you kept posted but in a way that is off the record or that you are not able to act on?
If it is off the record and the cabinet secretary admits that, it will be on the record.
It does not happen, either on the record or off the record.
I meant informally.
That has been the position for successive Governments in Scotland. The legislation has been in place since 2000. I was on the Justice and Home Affairs Committee when it dealt with the Regulation of Investigatory Powers (Scotland) Act 2000.
We were there together, cabinet secretary. How far you have come, and how far I have fallen.
As I said, when the 2000 act is revised, I will want to pursue the goal of ensuring that Scottish ministers are notified of any concerns that IOCCO or its successor has about any Scottish public bodies that have powers in this area of reserved legislation. That is a reasonable expectation, and such a requirement in legislation would provide ministers—and Parliament, to a degree—with an assurance that the Scottish ministers will receive feedback on any areas of concern that the commissioner highlights in relation to how a public body in Scotland operates in this area.
I will bring in members in order, because everybody’s questions are pretty much on the same area. Margaret Mitchell can go first, followed by Christian Allard, Alison McInnes and Margaret McDougall.
Good morning, cabinet secretary. You have stated on a number of occasions, and again today, that statutory oversight of the code of practice is reserved, and that that is therefore IOCCO’s duty. We now have the findings from the investigation. Does the Scottish Government have devolved competence in relation to any of the findings?
In what way? I am not entirely clear about the point of your question.
We know that there has been a breach of article 10, which relates to freedom of the press. The implementation of the ECHR is a devolved issue, so what is the Scottish Government’s reaction to that breach?
If I understand your point correctly, my initial answer is that there are no recommendations for the Scottish Government in the IOCCO report. Secondly, we are talking about an area of reserved legislation: the code of practice and oversight of it are reserved.
Police Scotland has developed an action plan following its own review of the matter, given IOCCO’s initial findings. IOCCO then conducted a further, detailed investigation following the report that it received from Police Scotland in August this year. Over the period, Police Scotland has developed its action plan to address the issues that have been highlighted, and it has shared that plan with IOCCO to seek its assurance that the changes that were being made would address the concerns and issues that IOCCO raised and that they would prevent such a breach from happening again.
IOCCO has now stated that Police Scotland has put in place robust measures to prevent a breach from happening again. We have an assurance from IOCCO—and an assurance through the action plan—that Police Scotland has taken a range of measures to prevent something similar from happening.
So, even though the Scottish Government has responsibility for and devolved competence in relation to the implementation of the ECHR and there has been a breach of article 10, it has no responsibility for the matter and will do nothing else to follow it up.
I am not entirely sure of the logic of that. There are issues with article 8 and article 10 that relate to some aspects of the matter. However, the oversight and the legislation are reserved, and action has been taken to put in place appropriate measures to prevent such a breach from happening again. I am not entirely sure what else you expect the Scottish Government to do.
I suppose that the Scottish Government could look at the implementation of article 10 and see whether there is any issue there. The committee is very frustrated that the Scottish Police Authority never seems to be hands on: there is always another assurance review that never seems to have very much teeth.
I am merely checking that, if there is an issue with the implementation of the ECHR, the Scottish Government is confident in its own mind—and you are confident in your mind—that everything possible has been done to ensure that there are no breaches of ECHR articles, over which we have devolved competence, in the wider scope of what is going on at Police Scotland. The issue that has been highlighted is very serious, as I am sure that you will appreciate. Freedom of speech in any democratic society is absolutely fundamental.
12:00
I am mindful that some people would like to abolish the Human Rights Act 1998 and remove it from our statute books.
Perhaps we would like it to be implemented better than it is, cabinet secretary.
That is a different debate—it is not the one with which I am familiar from the Conservative Government at Westminster.
Obviously, IOCCO considered ECHR issues during its investigation. It says that robust measures have been put in place to prevent the same thing from happening again. Given IOCCO’s expertise and knowledge in the matter, I am confident that those robust measures are now in place and, having considered the action plan, I am confident that the right measures have been put in place.
Margaret Mitchell will also be aware that one of the possible outcomes from such an investigation is that the matter can go to the Investigatory Powers Tribunal, which can consider the issues further and look at the extent of the impact on the individuals who were affected by them. I am aware from the media that one party has already indicated that they intend to take the matter to the tribunal, which will be in a position to examine it in more detail and consider how it has affected that individual and whether any further measures need to be taken as a result.
The individuals who believe that their rights have been infringed still have to go through that process. They have been notified of that by IOCCO, which then has a responsibility to ensure that it is furnished with sufficient information to progress any case to the Investigatory Powers Tribunal. That is a reserved area—it is part of the statutory provisions in the relevant legislation.
You have answered my question, cabinet secretary.
Good afternoon, cabinet secretary. I will ask for clarification about a point of detail that I might have misunderstood. Were you made aware of the change in relation to the code of practice?
We were made aware of the intention to introduce the code of practice towards the end of February this year. I had a discussion with the Home Office minister, James Brokenshire, who was responsible for taking it forward in the Home Office.
Did you discuss the point that quick implementation might be a problem? Did you forecast in your discussion any problem that might arise because the guidance was not enshrined in legislation and was only a change to a code of practice?
As I said earlier, part of the challenge was the fact that there was no time at Westminster for the UK Government to put the code on a statutory footing. The UK Government was also mindful that, because it intended to consider changes to the investigatory powers legislation in the new Parliament after the election—the committee will be familiar with that, as the UK Government has already set out its plan—the most practical way of dealing with the matter at the time was through a code of practice. It was clear that there was pressure on Westminster’s timetable because of the impending general election, and that there would be challenges in the code’s implementation. No doubt the Home Office was aware of that challenge, but the commissioner also highlighted it. However, the decision was made to make the code of practice available and to put it in place prior to the dissolution of the Westminster Parliament.
Do you agree that there was urgency at Westminster because of the need to protect journalists following attacks on press freedom?
I recognise that. It would be wrong to suggest that we were opposed to the code of practice. We welcomed it, and we believe that it should be put on a statutory footing rather than remain as a code of practice.
That is a helpful clarification, thank you.
DCC Richardson sought to excuse the breaches of the code of practice by saying that the guidelines were introduced at a pace that was aggressive and pressured. Do you agree that it would be reasonable to expect that, if the DCC was so concerned about that, he should have sought to make representations about it or should have asked you to make representations to Westminster about it?
It is fair to say that the timeframe for introducing the code of practice was very tight, and there is no doubt that there have been some challenges. The most recent figures from IOCCO may have resulted partly from that timetable. I am also conscious of the fact that forces across the UK will have had to apply the same rigour to the issue.
There were some challenges around the provision of guidance to the police by the Home Office and IOCCO. For example, one aspect of the timeline that may be of interest to the committee as it pursues the issues with IOCCO is the fact that it published its guidance on the independence of the designated person at the beginning of June. So, even with the code of practice coming into force on 15 March, there was still a gap in some of the guidance that was passed on to the police, other public bodies and other organisations that have powers in the area. It is reasonable for Neil Richardson to highlight the challenges that that may have created for the police at that point.
On a number of occasions, Police Scotland has had less regard to human rights compliance than I would have liked. I am thinking about what we have had to do in relation to stop and search, and now there is this. Are you comfortable and satisfied that Police Scotland has the necessary expertise within the organisation to fully comply with the ECHR, or do you feel that we need to review what is available to it?
Do you mean the legal expertise within the organisation in understanding the ECHR?
Has Police Scotland been properly advised and has it been able to roll out that advice throughout the organisation, so that it permeates everything that the police do?
Police Scotland has to comply with the ECHR in the same way as any other body in Scotland. In this instance, as you heard from Neil Richardson this morning, a mistake was made by a very experienced officer with considerable expertise in the area. Police Scotland must ensure that lessons are learned from that in order to prevent it from occurring again.
I am conscious that, as part of police training and Police Scotland’s on-going work, the police are regularly advised and updated on human rights issues and their implications to ensure that the approaches that they take are in line with the legislation. I have attended Police Scotland briefings for officers who have gone out on particular operations where that information has been reiterated to them. I think that there is a strong recognition within Police Scotland that it needs to be compliant with the ECHR and that it should not act in a way that would compromise that compliance.
However, in this particular case, there were deficiencies that resulted in the wrong judgment being made. I return to the point made by IOCCO that this was not a deliberate misuse of the legislation or a deliberate ignoring of the code of practice.
My question is about judicial approval, which is mentioned in the code of practice where it talks about the police requesting communications data to identify a journalist’s source. Is that a new requirement?
The requirement for judicial approval?
Yes.
Yes, it is. Prior to the code of practice coming into force, there was no oversight. The code of practice introduced judicial oversight.
The new code of practice introduced two key areas. One was the provision of a designated person to authorise a request for that type of communications data, and the other was judicial oversight around journalistic sources. The code of practice introduced new provisions in order to provide stronger safeguards in that area, because the report that IOCCO started in October 2014 looked specifically at how the police were using those measures when it came to journalistic sources; the two key parts of the code of practice are the designated person and the judicial oversight.
The code of practice came out in March.
It came into force on 25 March.
Would you expect an officer with the expertise that we have heard that Detective Superintendent Donaldson had to have picked up on those two points? Would he have picked up on the main differences and have been able to identify that judicial approval was needed to look into the matter?
You have heard Neil Richardson’s explanation as to why that did not come about, in that the officer who was dealing with the request took a narrow view rather than considering some of the wider issues, which resulted in his coming to a judgment that meant that the code of practice was not applied as it should have been. The oversight function through IOCCO’s inspection of Police Scotland identified the deficiency and asked the police to review the matter and to put appropriate measures in place to prevent it from occurring again. Neil Richardson is better placed than I am to explain, from an operational point of view, the process that the police use in taking those matters forward, but clearly an error has been made. In such cases, there should be judicial oversight of the decision.
The action plan that resulted from the review had 12 points on it. Eleven of those action points have been executed, as far as I know, except for the one on judicial review and approval. Is that not of concern to you, given that that was the issue?
My understanding is that Police Scotland is already in the process of putting in place the right judicial process.
It has not been implemented. That is what Mr Richardson told us this morning.
The police are in the process of putting in place the formal process to ensure that that happens and that that mechanism is available to them for any future decisions in those areas. It is not the case that they are not doing it; they are in the process of resolving that area that is identified in the action plan.
So it is not implemented if it is not resolved.
They are working to implement it just now.
As a point of information, the updated code of practice now requires the police to seek judicial approval in such circumstances. It is not a review, which is what I think Margaret McDougall mentioned.
In the action plan that we spoke about earlier, one of the points was around judicial approval. I forget his title, but Mr Richardson who was here this morning said that all the points had been implemented apart from the one about judicial approval.
As I said, Police Scotland is in the process of taking forward that action point in the plan. It is clearly in Police Scotland’s interests to ensure that that is addressed, because if the police deem it necessary to obtain communications data relating to the provisions within the code of practice, they will have to use the judicial authorisation process.
The point that I was trying to make is that it is not discretionary, it is mandatory, if those other tests apply.
Of course. They will have no choice.
Yes, but the police have not done it yet. The action plan has not yet been implemented—that is the point that I am making.
We will leave it at that for now.
12:15
Cabinet secretary, you have laid out a clear timeline of the Scottish Government’s engagement on the issue, for which I am grateful. Mr Richardson put forward a less than clear position, but perhaps clarity will come with the various follow-up notes that he is going to give us.
You have commented frequently on statutory oversight, and we all understand the role of that. Once again, the Scottish Police Authority looks like a bystander to or onlooker on a process—it is always playing catch-up. We are told that, in August this year, the SPA received a briefing from Police Scotland and that, three or four months later, it has instituted yet another assurance review. I hope that Mr Penman is getting additional resources for all the additional work that he is doing.
Yes, and a wee bit of a holiday at some point.
The budget statement is this week.
I am sure that you will have him in mind.
There is a very serious issue. What role do you see for the Scottish Police Authority? In effect, it is making itself redundant and, when it does become involved, it is playing catch-up and calling on the good services of Mr Penman and his staff, although we should all be grateful for the diligent work that they have done on stop and search, armed policing and the rest. Is the SPA doing itself out of a job?
No, I do not agree with that. Of course there are areas for improvement and ways in which the Scottish Police Authority can ensure that it undertakes robust and challenging oversight of the way in which Police Scotland operates to identify areas where it believes improvement could be made. The SPA does a range of that, but there is always room for improvement. I do not think that the SPA would say that there is no room for improvement.
It is worth reiterating that, on a statutory basis, oversight in the area that we are discussing lies with IOCCO, as is the case for every other police force in the UK. There is room for improvement in the way in which IOCCO engages and shares information with some of the oversight bodies that have a role on policing in general. Notwithstanding your view about the need for the SPA to get ahead of the curve, which I presume is your central point, it is worth keeping it in mind that the statutory oversight in the area that we are discussing is the responsibility of IOCCO, as is the case for every other police force in the UK.
I realise that it is a reserved matter and I know that you are not suggesting total disengagement. We have other groups. We have the Scottish Information Commissioner, the Office of Surveillance Commissioners and, perhaps most important in this regard, the Police Investigations and Review Commissioner. Surely a bit of proactivity is required of the Scottish Police Authority. The Justice Committee and the Justice Sub-Committee on Policing can do that, but the SPA has been behind the curve on every major issue.
As I mentioned, there are areas for improvement. We have a new chair in place, who is undertaking a governance review, which will report in the spring of next year. That is looking at how we can improve governance and make it more effective on certain policing matters. I am keen to ensure that we make progress on that. Given that the SPA has been in place for almost three years, now is a good time to look at how we can improve the governance and oversight process, and that work is being undertaken.
It is important that we do not lose sight of who has statutory oversight in the particular area that we are considering and the way in which that operates. However, the changes that are to be made to the commissioner’s role around the regulation of investigatory powers give us an opportunity to better reflect the changing relationship and the different architecture that we now have in place on policing and the oversight of the way in which it operates in Scotland.
Much of this takes place against the backcloth of the Emma Caldwell murder case being accelerated. It is interesting that the procurator fiscal wrote to Police Scotland on 25 May 2015 to tell it to accelerate matters, although I have not seen that letter. I respect the independence of the prosecution service from Government, but do you know anything about that letter?
No. You would need to pursue that directly with the Crown Office.
So you do not know anything about that. I raise the issue because we were talking about process, and that case is what the issue is really all about at the end of the day—that is the background. Questions arose about Police Scotland and who had leaked things to the papers. Police Scotland did stuff and we must accept that IOCCO says that it was not wilful but it was reckless. However, that did not happen in a vacuum. In the middle of all that, the investigation into that historical murder case took a step up. I am just wondering where that comes into it all, but you are not aware of that in any way.
It is a live investigation and it would not be appropriate for ministers to comment on it.
Absolutely not.
To explore further the Crown Office’s views on those matters, you would have to pursue that directly with it.
We need to speak to the Crown Office—that is fine.
We have no more questions, so thank you very much for your evidence.
12:21 Meeting suspended.