Current Cyber Kiosk Performance

The Management Information (MI) which is published on a monthly basis in respect of use of Cyber Kiosks is detailed and robust.

Although a Kiosk examination can assist with insight into the evidential value of a device, the decision on whether a device can be returned to the owner on conclusion of Kiosk examination depends on other criminal justice process factors; depending on the stage in the criminal justice process the decision will rest either with the enquiry officer, or the COPFS – never the Kiosk operator.

With respect to the return of devices, recent Crown Office and Procurator Fiscal Service (COPFS) guidance provides:

‘In terms of this guidance prosecutors are under an obligation that where a device can appropriately be returned to its user they should do so at the earliest opportunity. Before a case has been reported Police Scotland have to decide whether it can be returned. Once a case has been marked for prosecutorial action the responsibility for determining whether to return the devices lies with the prosecutor.

Some of the following factors will be taken into account when deciding whether a device can be returned.

• Whether there is an alternative way to secure the required information,
• Whether all of the relevant information has already been extracted from the device,
• Whether the device itself is required as evidence,
• The significance of the information,
• The views of the child witness (where the device belongs to a child),
• The reasons for the request.

It will not be appropriate to return a device where it may prejudice the defence or where the device contains illegal images or has been used in the commission of an offence.’

Details relating to the return of devices to owners is therefore not recorded on the Kiosk, CMS, or other Cybercrime system, and not published as part of Kiosk MI.

There is currently no single search across Police Scotland systems that can establish when devices that have undergone Kiosk examination have been returned to their owner. The national roll out of Core Operating Solutions (COS) includes a productions module. That system currently identifies if a production is a mobile phone and if it is retained or disposed of, but not how it has been disposed, for example, destroyed or returned to owner. Future enhancements may include the type of disposal and disposal instructor (Police / COPFS) but this enhancement if required will not be developed until the end of 2024 at the earliest due to other priorities. The inability to measure this was an omission in the delivery of Cyber Kiosks and something that we have learned from, for example in how we have recently implemented other technologies such as CAID FM.   

Management Information relating to the use of Cyber Kiosks is currently drawn from two main sources; the Cybercrime Case Management System (CMS), and the Cyber Kiosks themselves.

The CMS sits on the Police Scotland network and is a system used to record details of device examinations from initial request, through approval process and to examination outcome. The information on the CMS includes, but is not limited to, the number and type of devices being examined, and the Cyber Kiosk at which the examination took place.

Through the use of analytical tools, MI from the CMS relating to use of Kiosks can be readily collated, analysed and presented in the agreed format, ready for publication on the Police Scotland web-site. The MI gleaned from the CMS can be cross referred with the MI on the Cyber Kiosks themselves for audit and quality assurance purposes. However currently the Cyber Kiosks are standalone with no connection to the Police Scotland network. The only way to collect the MI for comparison is through manual extraction at each Kiosk location. 

The MI extraction can only be carried out by qualified Cybercrime Digital Forensic staff, with monthly extraction involving considerable travel to reach each of the 41 Cyber Kiosk locations.  With significant geographical spread of the Kiosks – from Dumfries in the South of Scotland, to Wick in the North - this travel represents significant staff abstraction and travel costs, particularly with some locations being so far from the Cybercrime Hubs as to require overnight accommodation. 

It is worth noting that the Kiosk visits also serve as an opportunity to quality check the Kiosks and associated equipment, and opportunity to carry out any required software updates; however, the absence of networking to allow remote access to the Kiosks via the Digital Forensic hubs means that any maintenance, upgrades, or other problem solving required out-with the visits, ultimately result in further in-person attendance at a Kiosk.