RIPA: Police Scotland's whoops apocalypse

On the 25th of March 2015, a new code of practice on the use of Regulation of Investigatory Powers Act came into force. RIPA, as it tends to be known, sets out the procedures and authorisations which public authorities - including Police Scotland - must employ if they want to intercept telecommunications, tap phones, or gain access to what is called communications data. Who owns this mobile phone? What numbers has it been calling? What telephone networks has the device being connecting to? What movements has its owner been making? This can be invaluable information in the detection of crime and terrorism, but it also throws up challenges when it comes to journalists' sources. 

The European Court on Human Rights regards the protection of journalists' sources as a critical aspect of Article 10's protection of free expression in a democratic society. To dig up journalists' sources, public authorities must show an overriding public interest. But imagine you are a curious police force, which wants to know where a troublesome hack is getting his information from. What do you do? The temptation is obvious. Identify the hack's mobile phone number. Dredge his communications data to find out who he has been blethering to. Trace the numbers back, and you may identify his sources, without anything so awkward as interrogating the journalist in question. Indeed, the hack whose sources have been traced in this scenario almost certainly has no idea what the hypothetical police force has been up to.

In an effort to control the behaviour of police forces, the new March 2015 code made serious changes. The amended code is a fairly long document -- but the sections on the additional protection which would be extended to journalists' sources seems crystal clear to me. It is worth underlining too: draft versions of this new code was laid before parliament at the beginning of March, and the issue of accessing journalists' communications data was repeatedly highlighted in the media. The changes were sprung upon nobody, including Police Scotland. So what does the new code say? And what did it change? It provided that in future:

Where an application is intended to determine the source of journalistic information, there must therefore be an overriding requirement in the public interest, and the guidance at paragraphs 3.78–3.24 should be followed.

Paragraph 3.78 summarises this - I should have thought - absolutely clearly. Here's what it says:

3.78. In the specific case of an application for communications data, which is made in order to identify a journalist’s source, and until such time as there is specific legislation to provide judicial authorisation for such applications ... law enforcement agencies in Scotland must use the appropriate legislation or common law powers to ensure judicial authorisation for communications data applications to determine journalistic sources. 

Got that? Comprehensible? This isn't a technical, jargon-laden text. It isn't a knotty section of a long and complex statute. It sets out the rule perfectly clearly when it comes to accessing data on a journalist's sources. Mystifyingly, Police Scotland conspired to "misinterpret" this new, crystal clear provision. Officers did what you might expect: secured access to several sources of communications data without seeking judicial authorisation of any kind. In November 2015, the Interception of Communications Commissioner concluded that Police Scotland had "recklessly" failed to follow the Code. "Reckless", that is, rather than "wilful". Police officers hadn't deliberately ignored the requirements of the new Code. They'd been negligent.

The official line from senior police officers is that the senior responsible officer regrettably "misinterpreted" the new rules. And today, Assistant Chief Constable Ruaraidh Nicolson appeared before Holyrood's Justice Committee in what seems likely to prove an abortive attempt to allay MSPs' fears about Police Scotland's behaviour here. It wasn't a particularly assured performance by the Assistant Chief, but for me, the critical question which remains outstanding is this. You've read the new code. You've seen its short compass. I bet you've understood it too. It makes it plain that judicial authorisation is necessary, if a police force - any police force - proposes to hunt down communications data on a journalist's sources. Scotland even warrants a special mention in paragraph 3.78 of the Code, for criven's sake.

How is it, therefore, that a senior and experienced officer in Police Scotland failed properly to understand this simple-simple new requirement? A "mistake", they say. A "misinterpretation". But I'm at loss as to how one could "misinterpret" this straightfoward text and conclude that judicial consent was, in fact, not necessary. It stretches credulity. After the Assistant Chief Constable's appearance before parliament today, I remain at a loss. Senior officers offer contrition, but their explanations remain garbled and unclear. And the stooshie rumbles on.