Digital Forensic Growth

This decision concerns investments for Digital Forensics which were presented to and supported by MPS Management Board during the recent phase 1 Priority Based Budgeting (PBB) process (September 20 – January 21). Additional investment in Digital Forensics is required to develop services to keep up with advances in technology in support of front line policing investigations, victims and the Criminal Justice System.

The Deputy Mayor for Policing and Crime is recommended to:

1. Approve the award of contracts to Cellebrite Ltd and MSAB Ltd via the CDW Ltd agreement in accordance with MOPAC’s scheme of delegation due to spend in aggregate exceeding £500k.

2. Approve the investment of £2m capital and £11.667m revenue.

3. Note that revenue funding has been allocated within the Medium Term Financial Plan from 2022/23.

4. Note that revenue funding for 2021/22 will be allocated from central budgets on a one-off basis with the exact amount dependent upon in-year recruitment. Budget moves will be reported via the Quarterly Financial Reporting process.

5. Note that Investment of £2m in Capital spend has been approved for technology infrastructure and Estates configuration in 2022/23 and will be included in the updated Capital Programme, which will form part of the 2022/23 Budget Submission.

1. Introduction and background

1.1. The approval of this business case is necessary for the MPS to ensure it maintains the ability to support operational delivery, assist with the investigation of crime and support front line policing. The digital requirements of police investigations have increased dramatically and there is an urgent and pressing need to invest in this capability to ensure the success of criminal investigations, reassure victims and increase confidence in the justice system.

1.2. The use of digital data and processing of digital evidence to meet the needs of the Criminal Justice System (CJS) and achieving the right balance to maintain the confidence of victims as part of investigations is paramount. This has been identified in a number of recent reviews and publications that outline the controls needed to improve compliance highlighting the way in which officers must deal ethically with digital devices and the extraction of material that is proportionate and necessary for the investigation but ensuring the right balance is achieved for victims of crime.

1.3. The Digital Policing challenges are set out in the NPCC Policing Vision 2025 and the Digital Forensic Science Strategy. This paper sets out how investment and development of capabilities can address these challenges and support both the strategic priorities of the MOPAC Police and Crime Plan and Met Direction. In addition investment is required to comply with the following publications which fundamentally impact the way digital data is extracted and reviewed in investigations:

• Data Protection Act 2018

• Director of Public Prosecutions (DPP) Guidance on Charging 6th Edition

• Attorney Generals Guidelines on Disclosure 2020

• Authorised Professional Practice - The Extraction of Material from Digital Devices 2021

• Information Commissioner’s Office - Mobile phone data extraction by police forces in England and Wales

• The End-to-End Rape Review Report on Findings and Actions – June 2021.

1.4. Supplies and Services – A revenue investment of £2m is required to deliver the current level of service and continue with the blended service model incorporating insource / outsource capabilities. This approach retains access to the digital market place to encourage casework innovation complementing the internal service provision which requires additional budget to fund licences and support for current technology capabilities.

1.5. Level 1 (Kiosk Service) - An additional £2.4million revenue investment is required for digital forensics to provide the additional kiosks, 34 Band E police staff to provide technical support to BCUs and free up officer time, supported by requisite supervisory posts and Digital Strategy Advisors and 2 Band I technicians supporting infrastructure and accreditation. This investment will also enable training of an extra 240 officers per year and implementation of a competence framework, which is required to meet regulatory requirements. Onsite support, training and mentoring will be a fundamental part of the role profiles.

1.6. Level 2 (Digital Hub) - An investment of £3.7m revenue, in conjunction with £2m capital, will pay for an additional four hubs and uplift of 67 FTE staff across all hubs to provide extended operating hours, further capacity and support BCU / SC within the geographical commands of the MPS. If capital investment is not available an alternate proposal would need to be considered, by expanding the current digital hub capacity and placing extra staff within existing locations, however this would provide challenges.

1.7. Level 3 (Laboratory Services) - An investment of £3.5m will provide an uplift of 33 FTE to increase capacity and capability in dealing with the most complex digital submissions, improve infrastructure and introduce evolutionary work flows to keep the MPS as a force leader in digital investigation along with funding in research and development. These additional staff will also provide resource to fully develop the quality management systems across all three levels of service to achieve regulatory compliance and assurance to the criminal justice system.

2. Issues for consideration

2.1. The investment requested will deliver efficiencies in frontline investigations and improve productivity across Digital Forensics by providing a whole system approach benefitting Policing and the Criminal Justice System.

2.2. This investment contributes to the Police & Crime Plan in a number of ways. Improved workflows supported by an increase in staff will enable improved turnaround times of forensic reports to officers and subsequently into the criminal justice system.

2.3. This investment will support the objective ‘to increase confidence in our response to violence against women and girls – for women to be safe and feel safe in London’ by reducing the turnaround time and enabling cases to be prioritised accordingly and improve chances of meeting the Policing Minister’s promise of returning devices back to victims within 24hrs.

2.4. A large percentage of the work submitted to Digital Forensics is in relation to offences involving Child Sexual Exploitation and Abuse. This investment will enable Digital Forensics to continue to develop systems and processes to deal with these cases swiftly and effectively supporting the Police & Crime Plan’s objective of ‘keeping children and young people safe’.

2.5. The investment requested will deliver efficiencies in frontline investigations and improve productivity across Digital Forensics by providing a whole system approach benefitting Policing and the Criminal Justice System.

2.6. Further information is contained in the restricted section of the report

3. Financial Comments

3.1. The table below summarises the funds requested, it should however be noted the overall £11.6m is an ongoing committed revenue spend (Overall increase in Forensic budget).

3.2. An ambitious recruitment plan will target the staff uplift over a two year period which will mean the full funding requirement is unlikely to be required until Q1 2023/24 and will be subject to a comprehensive recruitment strategy.

3.3. The capital requirement of £2m will be in the updated Capital Programme, which will form part of the 2022/23 Budget Submission.

3.4. The revenue required for 2021/22 will be funded from central budgets but the future funding required will be added to the Medium Term Financial for 2022/23.

3.5. Further information is contained in the restricted section of the report.

4. Legal Comments

4.1. The Mayor’s Office for Policing and Crime (MOPAC) is a contracting authority as defined in the Public Contracts Regulations 2015 (the Regulations). All awards of public goods and/or services contracts valued at £181,302 or more by contracting authorities must be procured in accordance with the Regulations. This report confirms the value of the proposed contracts to be awarded as a result of Recommendation 1 exceed this threshold. Accordingly, the Regulations are engaged.

4.2. All procurement activities will be conducted in accordance with Public Contracts Regulations 2015, using the MPS’ Value Added Reseller CDW for purchase of hardware where appropriate.

4.3. Following a procurement procedure, MOPAC entered into a single-supplier framework agreement with CDW Ltd for the provision a range of hardware and software for ad hoc projects, as well as hardware and software that are specialist in nature. Under Regulation 33 of the Regulations, a contracting authority may place call-off contracts with an economic operator with whom it has entered a framework agreement without further competition.

4.4. Paragraph 7.23 of the MOPAC Scheme of Delegation and Consent provides that the Director of Strategic Procurement has delegated authority to approve the award of all contracts, with the exception of those called in through the agreed call in procedure. Paragraph 4.14 of the Scheme provides the Deputy Mayor for Policing and Crime reserves the right to call in any MPS proposal to award a contract for £500,000 or above.

4.5. Paragraph 4.8 of the MOPAC Scheme of Delegation and Consent reserves to the DMPC the approval of business cases for revenue or capital expenditure of £500,000 and above.

5. Commercial Issues

5.1. There is a requested £2m uplift to the existing Digital Forensics Supplies and Services budget. This links to historical pressures and increasing demand. The expenditure within this area is predominantly split between specialist Forensic Service Providers (FSPs) and software, licensing and hardware costs.

5.2. Software, licensing and hardware costs. These requirements are provided compliantly with the Public Contract Regulations 2016 through CDW Ltd and are within total contract values.

5.3. Forensic Services Providers. The arrangements were held under the MPS’ managed services contract until 31st July 2021. Upon exit of the contract it became necessary for the MPS to directly enter relationships with the previous suppliers’ contractors. The Authority has entered into arrangements under MPS delegated authority with the subcontractors to maintain continuity of service whilst a new tender is commenced and awarded. A separate decision (PCD 1400) has approved the MPS to enter into longer term arrangements on an interim basis to allow for the full tender process and implementation of new arrangements. Further information is contained in the restricted section of the report.

5.4. In respect of expenditure made in relation to Software, Hardware and infrastructure this will be sourced under arrangements with CDW Ltd which offers a compliant route to market in accordance with the Public Contract Regulations 2015. Research and Development (R&D) is liable to be required on a project by project basis and therefore values are likely to be below OJEU value. R&D opportunities will be procured through compliant means and via competition in accordance with procurement rules and regulations. Training will be sourced through CDW Ltd in compliance with PCR 2015 as the vast majority of training will relate to the purchased licences and hardware. Any additional training needs falling outside of CDW will be below OJEU value and will be procured in accordance with procurement rules and regulations and existing contracts for training.

6. GDPR and Data Privacy

6.1. The MPS is subject to the requirements and conditions placed on it as a 'State' body to comply with the European Convention of Human Rights and the Data Protection Act (DPA) 2018. Both legislative requirements place an obligation on the MPS to process personal data fairly and lawfully in order to safeguard the rights and freedoms of individuals.

6.2. Under Article 35 of the General Data Protection Regulation (GDPR) and Section 57 of the DPA 2018, Data Protection Impact Assessments (DPIA) become mandatory for organisations with technologies and processes that are likely to result in a high risk to the rights of the data subjects.

6.3. The Information Assurance and Information Rights units within MPS will be consulted at all stages to ensure the project meets its compliance requirements.

6.4. As an extension to infrastructure and existing tools, existing DPIAs will be applicable and where new capabilities are introduced DPIAs will be assessed and completed as necessary.

6.5. This investment programme will ensure a privacy by design approach, which will allow the MPS to ensure compliance with GDPR.

7. Equality Comments

7.1. This business case has undergone an initial equality screening. Due regard has been taken to the Equality Act’s Public Sector Equality Duty.

7.2. Real consideration has been taken to assess equality impact caused by the proposed business changes. As a result no positive or negative impact has been identified to any individual and/or group safeguarded by a protected characteristic and those who are not.

7.3. As this is an extension of an existing service this work does not change any aspects relating to equality or diversity.

8. Background/supporting papers

8.1. Report.