Provision of information held by Northumbria Police made under the Freedom of Information Act 2000 (the 'Act')
As you may be aware the purpose of the Act is to allow a general right of access to information held at the time of a request, by a Public Authority (including the Police), subject to certain limitations and exemptions.
i) The number of crimes reported to your police force which fall under the Computer Misuse Act in each of the last 3 years (2015, 2016, 2017).
ii) Of those crimes reported the number which references the following terms in initial police reports:
• "Smart device"
• "Connected device"
iii) Summary details on the crimes reported in i) and ii).
iv) Outcomes of those crimes reported in i) and ii).
i) The number of crimes reported to your police force which fall under the Computer Misuse Act and makes reference to the following in each of the last 3 years (2015, 2016, 2017):
• "Jump box"
• "Penetration test drop box"
• "Drop box"
• "Raspberry pi"
ii) Summary details on the crimes reported in i) and ii).
iii) Outcomes of those crimes reported in i) and ii).
i) The number of crimes reported to your police force which fall under the Computer Misuse Act which are classified as "denial of service" attack in each of the last 3 years (2015, 2016, 2017).
ii) Summary details on the crimes reported in i).
iii) Outcomes of those crimes reported in i).
We have now had the opportunity to fully consider your request and I provide a response for your attention.
Following receipt of your request, searches were conducted with the Corporate Development Department of Northumbria Police. I can confirm that the information you have requested is held in part by Northumbria Police.
Questions 1i, 1ii, 1iii & 1iv, I am able to disclose as attached.
Please note, that crimes that are classed as ‘undetected’ may become detected if further information comes to light.
Additionally we will withhold information for any cases that are still under investigation and by withholding we will rely in the following exemption.
Section 30(1) Investigations
Section 30 is a class based qualified exemption which means that a public interest test is required.
Factors favouring disclosure for S30
There is a strong public interest in knowing how the police service investigates such matters. This would ensure the public that appropriate steps would be taken to ensure that the public is confident in the police service ability to achieve this. Furthermore, if it is felt that the police is not appropriately taking steps to protect the public, the disclosure of this information would enable an informed discussion on the matter.
Factors against disclosure for S30
Whilst such information may be released in order to serve a core policing purpose, it will only be disclosed if there are strong public interest considerations favouring disclosure. Northumbria Police has a duty to ensure all investigations are dealt with fairly and equally. Some of these crimes are not yet concluded and therefore disclosure of the data requested at this stage would hinder on-going investigations into these matters. Investigations would be required to ascertain whether a person should be charged with an offence or if any person charged with an offence is guilty of it. These facts have not yet been established and to disclose any information prior to any investigation being complete would not be appropriate and therefore not considered.
Whilst these are under investigation we are unable to provide any information as to the circumstances of any allegations. To do so would not be fair to any persons involved and could impact on all on-going enquiries.
You should consider this to be a refusal notice under Section 17 of the Act for that part of your request.
For the remaining questions I can advise as follows:
2i, 2ii and 2iii. No information held.
In relation to all of question 3, the following exemption applies.
Section 31(1(a)(b) Law Enforcement
Section31 is qualified and prejudice based exemption and therefore the legislators accept that there may be harm if released into the public domain. The authority has to consider and describe the harm that would occur if the information were released and carry out a public interest test. In accordance with best practice, I detail the harm first.
The public expect police forces to use all powers and tactics available to prevent and detect crime and maintain public safety. It is vital that the police obtain information to ensure the arrest and prosecution of offenders who commit or plan to commit crime, whereby their modus operandi may involve ‘hacking’ into secure databases. In order to achieve this goal, it is vitally important that we do not compromise information and investigations in the fight to deprive criminals the opportunity to commit crime. Offenders would understand what actions the police may take in an investigation and seek to avoid detection or continue offending by exploiting this information. This may assist criminals in determining the effectiveness of detecting such attacks and could compromise measures to protect companies ICT systems, leaving them vulnerable with a loss in company confidentiality and integrity. It could also assist in criminal activity if the information was used by malicious parties to conduct future attacks.
S31 Factors favouring disclosure
There is a strong public interest in knowing how the police service investigates and collates evidence in relation to offenders. Knowing that the police has appropriate steps in place to ensure the safety of the public and apprehend those committing such crimes would ensure that the public is confident in the police service ability to achieve this. Furthermore, if it is felt that the police is not appropriately taking steps to protect the public, the disclosure of this information would enable an informed discussion on the matter.
S31 Factors against disclosure
The disclosure of the information would enable offenders to have knowledge if any such attacks had taken place and would undermine future and current investigations. Offenders would be able to take steps to circumvent the actions taken by the police which would have a direct impact on ensuring the safety of the public and bringing offenders to court. The recent NHS attack on their computer system was widely publicised which left them vulnerable and compromised their data. By confirming nor denying that we had investigations into ‘denial of service’ attacks, would open the door to criminals who believed that businesses/companies were easy targets.
Although there is a public interest in knowing how the police investigate such matters, to disclose this information would undermine that process. There is already considerable information about how the police support and target offenders, through local or national initiatives. However to provide the information would undermine investigations and would lead to offenders being able to avoid detection. This would increase the number of crimes committed and the number of victims. The police service has a duty to protect and the disclosure of this information would certainly have an effect on the police service’s ability to do so. After careful consideration it is therefore felt that the decision to exempt the information outweighs the public interest.
Northumbria Police can neither confirm nor deny that it holds any other information with regard to this part of your request as the duty in Section 1(1)(a) of the Freedom of Information Act 2000 does not apply by virtue of, S31(3) and S24(2) for any other information that may or may not be held.
FOI 212-18 - Crimes - Computer Misuse Act - Summary