Remote Search & Review Full Business Case

This business case is requesting approval to implement the Remote Search & Review application. The scope of the Remote Search and Review (RS&R) Project is to implement an Enterprise wide IT solution to provide frontline officers with the self-service capability to review forensically recovered data from digital devices for evidence and disclosure purposes.

Due to increasingly large volumes of data involved in police investigations, “It is clear that the right thing to do in these cases is to adopt new, technology-based approaches to managing this scale of material because its growth is outpacing human capacity to handle it.” (Attorney General - Disclosure Review Nov 2018)

The MPS have a business need for a new data search and review tool so that investigators can search large volumes of data efficiently and accurately, in a forensically sound manner. It will also improve compliance, collaboration, reduce burden on Forensic examiners, increase accessibility and provide enhanced functions improving the effectiveness of digital investigations.

The Deputy Mayor for Policing and Crime is recommended to:

1. Approve implementation of an Enterprise wide Remote Search & Review Solution.

2. Approve progression through gate 3 (Investment Decision) and into implementation.

3. Approve a total project cost of £16.5m – of which:

a. Total capital investment cost of £7.3m

b. Total ongoing revenue increase of £1.9m p.a. for first 3 years then £3.5m p.a. after (23/24 onwards) from MPS revenue budget.

4. Note that the claimed benefits are realistic and acceptable.

5. Approve procurement via direct award call off from the CDW contract.

6. Note incremental phased roll out delivery plan.

1. Introduction and background

1.1. The proliferation of digital devices has meant an increase in the amount of digital data available in the course of an investigation. Consequently the number of devices seized during a criminal investigation and the volume of data recovered has substantially increased. Forensically recovered data from digital devices can be critical to criminal investigations and there are few investigations now that don’t have some kind of digital footprint.

1.2. The MPS Forensic Services responded to the increase in demand for forensically extracted data from devices by introducing a three tier system.

a. Level 1: Self Service Kiosk, located in police stations with data extracted from supported devices by specially trained officers.

b. Level 2: A digital hub where trained police staff have access to a variety of extraction tools.

c. Level 3: The digital forensics laboratory, reserved for complex cases or complex extractions. Data is extracted using a variety of tools by specialist digital forensic police staff.

2. Issues for consideration

2.1. Currently data downloaded from mobile phones is held on disc, or USB and reviewed by officers on stand-alone systems. This creates a data protection risk as discs and USBs can be lost or misplaced during the criminal justice process. Due to the volume of data it is often extracted on to numerous discs. The officer then needs to load the discs separately onto a standalone computer which can be time consuming or cause technical faults if not done correctly. With the move to more agile working most stand-alone computers have been removed and the laptop cannot support data transfer from discs nor does it support the proprietary software viewing tool so there is often a delay whilst an officer locates an available stand-alone. Because of this officers might chose to download their data into excel or PDF which creates an even more difficult review process but can be done on their laptop.

2.2. This process builds in delays which means the officer will need to hold onto a victim’s phone for some time, maybe even months, during which the victim will not have access to their phone or data.

2.3. So much of our modern life is dependent on and revolves around digital devices, losing that device for any length of time can add to the trauma suffered by victims. Victims are reluctant to give up their phones and will withdraw support for a prosecution. This ultimately means even serious cases may never make it to court.

2.4. There is an urgent need to introduce a simple data search and review tool to assist officers to find crucial evidence within the vast volume of digital data that a device can generate. The concept for the need for such a tool has been accepted within the MPS for some time but the escalation of its importance has been expedited by recent failures in disclosure and a step change in the demands on the MPS from the Criminal Justice System.

2.5. Remote Search & Review will collect data extracted from digital devices at the kiosk, hub or lab and present it to the officer via a web based browser on their laptop. It will be simple to use with minimal training required, will eliminate administrative inefficiencies such as handling removable media and finding suitable review workstations, this reduces the risk of data protection breaches if portable media is lost or misplaced. It will enable effective data search, review and production into evidence or intelligence of relevant material. It will also support data security and retention objectives for the MPS.

2.6. The speeding up of data review processes enables the investigating officer to progress the investigation more quickly potentially providing a swifter outcome for the victim. Where the victim has had to give up their phone it provides opportunities earlier in the investigation for the investigator to return the phone.

2.7. Remote Search & Review has the following capabilities:

a. Officers can search large volumes of data efficiently and accurately in a forensically sound manner

b. Officers can search multiple devices at one time making it easier to identify and link communication between parties.

c. Intuitive layout of data making evidence easier to find

d. Protection of personal data of victims and witnesses through enhanced search criteria and audit facility

e. Increased system accessibility with digital transfer of data – capable of accessing from any MPS laptop or Aware terminal.

f. Opportunity for officer collaboration on cases with high volumes of data requiring review.

g. Secure review of data – no requirement for data to be placed on movable media e.g. USB or disc

h. Produces evidence in a standardised report format for the CPS.

i. Officers encouraged to document their review strategy and identify reasonable lines of enquiry

j. Designed to assist with disclosure obligations – use of tags to highlight evidence, and other relevant but unused material.

2.8. Whilst there are no cashable savings from the use of this tool, there are a number of significant efficiency savings which will be realised, estimated to amount to around £12m in non-cashable savings over a 5 year period, including:

i. Faster analysis of data and reduced investigation length (x3 faster)

ii. Increased Collaboration amongst investigators (can work in tandem)

iii. Reduced travel time and wait time for workstations to use software

iv. Reduced duplication and creation of automated reports

3. Financial Comments

3.1. The total funds being requested are:

a. £16.5m total project cost over 5 years – of which:

i. Total capital investment cost is £7.3m

ii. Total ongoing revenue increase of £1.9m p.a. for first 3 years then £3.5m p.a. thereafter (23/24 onwards)

3.2. The estimated total one-off investment to deliver these benefits is £7.3m (Capital) from the Capital Programme then £1.9m p.a. ongoing Revenue for the first 3 years until initial license agreement expires, then ongoing Revenue increases to £3.5m p.a. thereafter. The revenue costs will be funded from the MPS revenue budget.

4. Legal Comments

4.1. MPS Directorate of Legal Services (DLS) and Crown Prosecution Service (CPS) have been consulted as part of the assurance process and no concerns have been raised to date. Key stakeholders, including DLS and CPS will be engaged throughout the project and prior to the implementation of any change.

4.2. The Mayor’s Office for Policing and Crime (MOPAC) is a contracting authority as defined in the Public Contracts Regulations 2015 (“the Regulations). Consequently, the MOPAC is subject to the general principle of transparency under the procurement rules. Further, all awards of public contracts for goods and/or services valued at £181,302 or above must be procured in accordance with the Regulations. This report confirms the proposed contract exceed the above threshold. Accordingly, the Regulations are engaged.

4.3. The report identifies CDW as the preferred procurement route. This will be compliant with the Regulations where the MOPAC is an eligible user and the scope MOPAC’s requirement is within that offered under the Framework.

4.4. Paragraph 4.8 of the MOPAC Scheme of Delegation and Consent provides that the Deputy Mayor for Policing and Crime (DMPC) has delegated authority to approve business cases for revenue or capital expenditure of £500,000 or above.

4.5. The MPS retrieve data from digital devices with informed consent in the case of victim/witnesses when a Digital Processing Notice is provided, or as part of a criminal investigation under the search, and seizure and retention powers provided by the Police and Criminal Evidence Act 1984 (PACE). Although not a statutory requirement, the MPS also requires authorisation by an officer of the rank of Inspector in order to extract and copy data at level 1. At level 2 and 3 authorisation is required from a Digital Strategy Advisor.

4.6. Officers are bound by Article 8 of the European Convention on Human Rights (ECHR) in relation to the test of necessity, legality and proportionality and the Police Code of Ethics. All information recovered in the course of a criminal investigation is handled in accordance with the provisions of the Criminal Procedures and Investigations Act 1996 (CPIA). The processing and storage of material recovered by police is governed by Codes of Practice for the management of Police Information 2005 (MOPI).

4.7. Further legal advice is contained in the restricted section.

5. Commercial Issues

5.1. The recommended procurement approach is for an award of contract to CDW, the current MPS Value added reseller, for application software, licensing, training and professional services from Magnet Review worth £5.9M for a period of three years, from January 2020, with an option to extend for a further two years.

5.2. Following a competitive tender exercise, MOPAC approved the award of a value added reseller contract to CDW from Lot 2 of the technology products crown commercial services framework (decision PCD 507 signed in December 2018 refers). This is a call-off contract within scope and value of the CDW contract and complies with Public Contract Regulations 2015.

6. GDPR and Data Privacy

6.1. The MPS is subject to the requirements and conditions placed on it as a 'State' body to comply with the European Convention of Human Rights and the Data Protection Act (DPA) 2018. Both legislative requirements place an obligation on the MPS to process personal data fairly and lawfully in order to safeguard the rights and freedoms of individuals.

6.2. Under Article 35 of the General Data Protection Regulation (GDPR) and Section 57 of the DPA 2018, Data Protection Impact Assessments (DPIA) become mandatory for organisations with technologies and processes that are likely to result in a high risk to the rights of the data subjects.

6.3. The Information Assurance and Information Rights units within MPS will be consulted at all stages to ensure the project meets its compliance requirements.

6.4. A DPIA has been completed for this project. The project will ensure a privacy by design approach, which will allow the MPS to find and fix problems at the early stages of any project, ensuring compliance with GDPR. DPIAs support the accountability principle, as they will ensure the MPS complies with the requirements of GDPR and they demonstrate that appropriate measures have been taken to ensure compliance.

7. Equality Comments

7.1. The application may be used by all Officers. As it will be hosted on the Met Aware system it will comply with Met systems equality standards. An EIA has been completed and this did not identify and impact on any protected character. However we will continue to monitor this and an action plan will be drafted alongside each protected characteristic should it be identified that any are impacted.

7.2. Impact to individuals and communities outside the MPS continues to be assessed. Initial findings show that it significantly speeds up the digital review process which can lead to shorter investigations and swifter judicial outcomes. This is a positive impact for victims and communities.

7.3. An interactive training video will be completed for officers who will need to pass the examination element of this training video in order to access the system. This video will show officers how to use the tool focusing on the capability and functionality, for example how data can be filtered to protect a victim’s privacy as part of a “reasonable line of enquiry”.

8. Background/supporting papers

8.1. Report