ASPECTS OF THE INVESTIGATION
International nature of terrorism
49. The police briefing note mentions Operation Springbourne
(the 'ricin' plot), noting that it involved 26 countries in addition
to the United Kingdom.[55]
We were also given in confidence details of a number of other
investigations, some still sub judice, others concluded.[56]
Of four concluded investigations since September 2003, two involved
7 countries, one 11 and one 17.
50. No witness disputed that terrorism cases might
involve gathering evidence from a significant number of countries,
but some argued that the same was true of other forms of crime.
Liberty, for example, commented that:[57]
"white collar fraud can involve huge amounts
of material and any number of jurisdictions. Yet pre trial detention
is limited to a maximum of four days, less than a third of the
current time permitted for terrorism detention".
51. It is of course the case that many non-terrorist
crimes involve complex international elements over a number of
countries, and that pre-charge detention is significantly shorter
than in terrorism cases. But the unique feature of terrorism cases
is the emphasis that has to be given to the protection of the
public while the investigation proceeds.
Multiple identities
52. Two of the four operations mentioned in paragraph
49 did not involve multiple identities (although in one two false
passports were discovered); in one of the others 3 suspects had
ten identities with four false passports and 10 false identity
documents, and in the last, in which there were 7 suspects, 860
passports and identity cards were accompanied by 2,500 other forged
documents.
53. Liberty could not see how difficulties in establishing
identities of terrorist suspects would present any significant
hindrance, since multiple identities were not a new phenomenon
in criminal investigation and people could be charged under an
identity they had assumed if that was a name by which they were
known.[58]
54. Those investigating contemporary terrorism
cases not only have to identify the individuals concerned, but
also to understand the roles they played in complicated conspiracies.
We therefore think that it is reasonable for the police to cite
multiple identities as a complicating factor in their investigations.
Computers
55. Technical experts disagreed on the length of
time it takes to analyse a hard drive to discover whether there
is unencrypted material of interest or encrypted material. The
preliminary stage is taking a copy of the hard drive ("imaging"),
which in the police's theoretical case study is said to take a
minimum of 12 hours. Peter Sommer of the LSE described this as
"something of an exaggeration" and asserted that: "modern
imaging products claim rates of up to 5GB per minuteso
that even a comparatively large hard-disk of 120 GB would be imaged
in 30 minutes. The only real problems are with some laptops where
direct access to a hard-disk may be difficult".[59]
David Lattimore, Technical Manager of the Digital Crime Unit at
LGC Ltd, told us that most of the computers he dealt with needed
imaging overnight.[60]
Similarly, Mark Morris, Head of Forensics at LogicaCMG plc, noted
that in a recent non-terrorist case the forensic imaging took
30 man-days in machine time: he believed that Mr Sommer's evidence
did not reflect the issues faced in a complex and serious inquiry,
in which information gleaned from an interview might entail the
re-examination of computer media.[61]
56. Witnesses did agree that it depended entirely
on the circumstances of particular cases whether evidence obtained
from computers was significant; as Mr Sommer put it:[62]
"Sometimes the computers are at the heart
of it and sometimes they are entirely peripheral. That applies
to any form of crime in which computers are involved as well as
the terrorist cases. I currently am instructed in three terrorist
cases and in one of them the computer evidence is really fairly
peripheral, but there are a lot of other types of evidence in
terms of what was located. The computer evidence may slightly
strengthen or slightly weaken the police case but in other instances
it can be absolutely at the heart of it".
Mr Lattimore said that in 70% or 80% of the cases
in which he was involved, the computer evidence was needed before
a charge could be brought.[63]
57. We were also told that encryption was in practice
less of a problem than had been feared. For example, Mr Sommer
cited Operation Ore, a major paedophile inquiry, in which among
7,200 suspects there had only been 20 instances where encryption
had been a serious problem.[64]
Ross Anderson, Professor of Security Engineering at Cambridge
University, told us that:[65]
"In the case of decryption, there are still
a few products around where the act of searching for a key may
take time, but this is largely a thing of the past. Encryption
products nowadays tend to be either good or useless, and if they
are good then you either guess the password or you give up".
58. Witnesses also agreed that the police might not
be exploiting existing capabilities fully. For example, David
Lattimore told us that "often some encrypted files/volumes
are found however others are missed because the investigator is
not familiar with the techniques being used by the suspects",[66]
while Mark Morris observed that "the most common forensic
tool used by Police is not very effective in even revealing encrypted
data, and it is feared that many times such evidence may be overlooked".[67]
Professor Anderson argued that the quantities of data available
in trials, both civil and criminal, were increasing much more
rapidly than the capabilities of the police (or the justice system),
which would need a step change.[68]
59. The National Technical Assistance Centre, a Home
Office unit which provides technical support to UK law enforcement
and intelligence agencies, explained how long decryption might
take:[69]
"An initial examination will reveal the
extent of the encryption and indicate the likelihood of success.
This process takes less than a week. The subsequent timing of
the case is wholly dependant on the type of encryption applied
and the nature of the forensic information recovered from the
suspect computer. For example NTAC have processed cases for over
one year and have still remained optimistic of obtaining a successful
result. Other cases have been completed in less than a week.
In general terms however it would be fair to
say that if resolution of a case had not been possible after a
reasonable period then the likelihood of a positive result diminishes
significantly. An exact value for the length of this period is
hard, if not impossible, to determine precisely due to the variety
of factors involved. Past experience has shown that two months
is usually adequate if a result is possible although this might
extend to three months where a substantial amount of data or a
large quantity of computers and media are involved. After these
timescales the case officer will, in most cases, have secured
a result; have identified indicators which pointed towards a positive
outcome with considerable further work or concluded that the chances
of success were limited or non existent".
60. Professor Anderson did not believe that technical
challenges would justify an extension of maximum detention. He
argued in essence that work expands to fit the time available:[70]
"In my experience people take as much time
as they have got. Even if you have got a civil case that drags
on for months and months and months, the work is always done in
a rush just before the deadline to submit papers. [...] My view
tends to be, based on my experience of these things, that you
work for a certain amount of time on a heap of data and then you
run out of ideas or you run out of puff or you run out of money".
61. The other technical experts who gave oral evidence
to us were readier to accept that 90 days might be desirable in
some cases. David Lattimore told us he personally had worked on
cases that had taken more than 90 days to crack.[71]
Peter Sommer agreed that there might be "very, very rare"
occasions on which the police might need up to 90 days to carry
out computer decryption and analysis before charging suspects.[72]
62. The police agreed that analysis of material found
on computers was generally more time-consuming than decryption.[73]
They accepted that the amount of potential evidence to be found
on computers had led to changes in the approach to an investigation.
As DAC Clarke explained:[74]
"Traditional, good detective work is that
you follow the evidence wherever it takes you and that is the
purity. You keep an open mind from the beginning of an investigation
and follow the evidence where it takes you. However, with the
weight of material we are now seeing, what we actually have to
do is to set clear priorities at a very early stage and we have
to make choices around which material we are going to try and
access on computers or through mobile phones or overseas and hope,
and it really does come down to hope, that that will yield the
evidence we need prior to the end of what is now the 14-day period".
DAC Clarke went on to point out that these early
choices could have significant effects, for example, if it was
decided not to investigate a computer that later turned out to
contain significant material, individuals might be released who
would otherwise have faced serious charges.[75]
63. Encryption of data does not appear, for the
time being, to be the problem in practice that had been feared.
However analysis of data on computers, both unencrypted and decrypted,
is time-consuming and resource-intensive. This will be an increasing
problem for all types of investigations.
Regulation of Investigatory Powers Act
64. Some witnesses suggested to us that difficulties
over encryption of data would be at least alleviated if the Government
brought into force Part III of the Regulation of Investigatory
Powers Act 2000 (RIPA), which provides that if someone has an
encryption key and refuses to hand it to an authorised person,
he or she will be liable to up to two years in prison.[76]
Liberty pointed out that ACPO had also called for Part III to
be brought into force.[77]
65. Other witnesses doubted that this would make
much difference in practice. Mr Lattimore and DAC Clarke both
argued that a suspect facing a long prison term for terrorism
offences would be likely to refuse to surrender a key and accept
a two year term as the lesser evil.[78]
Professor Anderson believed that tax evasion or social security
fraud would be more likely to provide charges on which to hold
suspects.
66. The then Home Secretary told us that Part III
of RIPA was not in force because the amount of data encrypted
was much less than had been expected when the Act had been drafted,
but added that the Home Office would conduct a public consultation
on a draft code of practice, after which Parliament would be asked
to approve a statutory code.[79]
(This consultation, begun in early June, is scheduled to end on
30 August 2006.) He also pointed out that the Terrorism Act 2006
increased the prison term for non-disclosure of an encryption
key from two to five years in national security cases.[80]
67. Clearly, bringing Part III of RIPA into force
would not solve the problem of encrypted data; it could nonetheless
provide a useful instrument in some cases. We therefore welcome
the Home Office's expressed intention, following consultation
on a code of practice, to bring Part III into force. It should
do so as soon as possible.
Forensics
68. No witness disputed that forensics were time-consuming
in terrorism cases, but the Director of Liberty believed that
this was a problem that could be solved by increased resources.[81]
Liberty's written submission also argued that it was quite common
in criminal cases for the majority of forensic evidence to be
accumulated post charge.[82]
Although DAC Clarke told us that the focus of police work was
shifting from forensics to analysis of technological data,[83]
the police's written submission makes the point that forensic
processes involve highly skilled law enforcement and specialist
agency personnel. The police also argue that only a limited number
of people can ensure safety and continuity of the task at any
given time.[84] The volume
of seized material is also a factor: in many of the investigations
referred to in paragraph 49 there were thousands of exhibits,
and in one of them over 44,000.
69. The police's argument that forensics are time-consuming
is not disputed, and we also accept that this is not an area in
which greater resources would have an effect because of the need
for continuity of the investigation, which can only be ensured
by using a team of skilled personnel.
Mobile phones
70. Experts on mobile telephony who gave evidence
to us agreed that obtaining data from the handset of a mobile
phone can be time-consuming. For example, Vinesh Parmar, Telecoms
Forensic technical manager, Digital Crime Unit, LGC Ltd, told
us that "on average a complete data recovery and presentation
process for one device can take between 4 to 8 hours, this is
solely dependant on the device in question and in some cases this
time frame may be doubled or tripled".[85]
But he and other witnesses also agreed that difficult cases were
not common and that there had been little, if any, increase in
encryption of data on mobile phonesalthough they did not rule
out an increase in problems in this area in the future.[86]
They further agreed that the main challenges were found not in
retrieval of data from the handset, but the analysis of the records
of calls made provided by the telephone companies;[87]
all were clear that they would welcome up to 90 days in some cases.[88]
They also raised doubts over training for and the technical capabilities
of the police: Mr Parmar, for example, said:[89]
"Too often we get requests which say we
want everything, which in reality is not a workable request. What
we find is that law enforcement agencies need to start understanding
the data that is available and to start understanding what is
possible evidence or what is intelligence and they need to split
it and make valuable requests to us so that we can do the best
job we can. At the moment a lot of work we do is fishing expeditions
where we are basically requested to grab everything out of there
and we do not know the case history".
The police agreed that long-term investment and training
were needed to ensure that officers kept up with the pace of technology,
but denied that their training was inadequate.[90]
71. AC Hayman said that relationships with the phone
companies, who had to balance the liberty and privacy of the user
with the need to investigate serious crimes, were good.[91]
Mobile phone experts were also satisfied with the speed of response
from the networks, although they did call for legislation to ensure
that data should be both retained for longer periods and standardised.[92]
72. It is clear from the evidence we received
that the analysis of data such as records of calls made from mobile
phones can be an important part of an investigation, but that
the process is also lengthy and complicated. We therefore think
it is reasonable for the police to support their case by pointing
to the difficulties caused by the analysis of mobile phones.
73. We received evidence that each of the above
factors complicated the investigation of terrorism offences. We
also received evidence that it was the combination of the issues
in individual investigations that created the real problems. Opponents
of extended detention tended not to address the complexity of
the issues involved and to understate the challenge faced by the
police. In our view, the important point about the above elements
is that recent terrorist investigations have involved all of them.
Their individual impact is often significant but it is their cumulative
effect on investigations that is central to the case for an extension
of maximum pre-charge detention.
THE PROCESS OF DETENTION AND INTERVIEWING
Interpretation
74. Ms Peirce disputed that difficulties in finding
an interpreter caused delays either in questioning a suspect or
providing access to them for his or her solicitor, arguing that
there was no shortage of Arabic interpreters.[93]
Liberty argued that it was likely that any non-British national
arrested on suspicion of terrorism would be detained since the
Home Secretary would determine that their presence was non conducive
to the public good, while a UK national would speak English or
at least one relatively commonly spoken national language. They
further commented that 'Difficulties in obtaining interpreters
demonstrate why [
] the goodwill of differing racial and
religious groups within the UK is vital'.[94]
75. DAC Clarke responded that interpreters were not
only needed for the process in the police station, but also, for
example, for transcription and translation of intercept material.
Such work entailed security clearances for interpreters. He also
argued that some of the dialects used were rare and that in at
least one case no competent interpreter could be found in this
country.[95]
76. We were not convinced by the evidence that
provision of interpreters is a significant difficulty.
Religious observance
77. Liberty questioned whether the need to allow
time for religious observance created any significant problem
since Police and Criminal Evidence Act 1984 already specified
the need for regular breaks.[96]
The police did not try to suggest that "regular religious
observance"and it was not disputed that this meant Muslim
prayersadversely affected the amount of time available for interviewing
suspects. DAC Clarke described this as "another issue which
we have to take into account when looking at the overall time
available for the investigation to be completed in a proper fashion".[97]
78. We recognise that the need to allow time for
religious observance complicates the organisation of an investigation:
we do not, however, accept that it justifies an extension of the
maximum detention time.
Solicitors
79. British Irish Rights Watch told us that their
experiences in Northern Ireland indicated that, while the number
of solicitors representing suspected terrorists was relatively
limited, this did not have an impact upon investigations, and
they strongly cautioned against any restrictions on contacts between
lawyers and their clients.[98]
Ms Peirce knew of one case in which one firm had acted for the
majority of detainees and commented that:[99]
"the only professional way in which you
could represent people would be if you had the manpower, or womanpower,
to do it. Certainly, speaking from my experience, in our firm,
if we were asked to act for more than one person, we would only
do so, and could only do so, if we were able to act responsibly
for that person".
She believed, in the example she cited, that the
firm did have a very large number of people available, and was
therefore 'dubious' about the legitimacy of the police's example.
80. DAC Clarke disagreed:[100]
"I think there have been occasions when
what anybody else would recognise as clear conflict of interests
have arisen through multiple representations of clients by one
firm, and of course that is not a matter for us as police officers
to point out to those professionalsthat is a matter for
them to recognise themselves. I would say undoubtedly there have
been occasions when the representation afforded to people has
not been of the highest standard because of this multiple representation
issue".
He added:[101]
"It is not for me to second-guess a professional
judgment of lawyers because we do see certain patterns and I do
find it strange when, say, we have nine people in custody, eight
of whom are represented by the same firm, and they all receive
identical advice even though their circumstances are radically
different as I am not sure that each individual suspect is getting
the best possible advice".
81. We asked the police to provide us with an
analysis of at least ten recent terrorist investigations showing
how many suspects in each inquiry were represented by the same
solicitor or the same firm. They provided this material in confidence,
but it is clear that on more than one occasion a single firm with
a small number of solicitors has represented more than double
that number of suspects, who were the large majority of those
arrested. We doubt therefore whether those suspects were represented
to the highest legal standards: this of course raises questions
of whether justice has been properly served. But the police are
also concerned that such multiple representation may hinder effective
investigation, for example by making it more difficult to schedule
interviews of a number of suspects represented by the same solicitor.
Be that as it may, it is not clear to us that the problem provides
a strong case in itself for the extension of pre-charge detention.
Solicitors' advice to the public
82. When we visited Paddington Green Police Station,
Anti-Terrorist Branch officers mentioned a leaflet distributed
by a firm of solicitors, which urged members of the public not
to co-operate with the police. We were later told that this referred
to a leaflet distributed by Arani & Co., which contains the
following advice to the public:[102]