Two years ago, Police Scotland invested £500,000 of public money in 41 desktop-sized devices known as cyber kiosks.

These might sound like something from Doctor Who, but they are actually a very sinister, and quite possibly unlawful technology that will allow police to override the encryption on smartphones and look at much of the data they contain.

They had originally planned to deploy these devices from Autumn 2018. But worries over the legality of their use meant they have stood idle for the past two years, apart from a few highly controversial tests.

Now they have got legal approval to begin to use them across Scotland, although there are still plenty of accusations that they are still not legal.

How cyber kiosks work

Cyber-kiosks are desktop-computers loaded with specialist software that can be plugged into a smartphone or laptop and is able to extract much of the data contained on the device without the need for a passcode and bypassing any encryption that may be in place.

Police Scotland claims that cyber kiosks are only used by specially-trained officers and insists that any data that is viewed from a device is deleted from the cyber kiosk immediately after use. They do admit that the kiosks have the function to store data but insist this has been disabled.

They also claim that officers will only view the data necessary to progress their investigation. If they do find evidence, the device will then be passed to the Police Scotland cyber-crime unit for further examination.

Police Scotland also insist that they will not be looking at all the data held on a device. Rather they can limit searches by both data types and specific time periods.

While this is true, it is clear from their explanatory video that they have the capability to look at images, messages, call logs, contacts, videos, and files. While they can restrict searches by time periods, there is also an unlimited option which means they can, if they wish, search a device completely.

Why Police Scotland bought them

Police Scotland argues that a big benefit of using cyber kiosks is that they can analyse seized devices from witnesses and suspects faster and so minimize inconvenience and ‘provides a better service to the public’.

They argue that it will also help them speed up investigations. They claim smartphones and tablets are a major part of many investigations and they examine up to 15,000 devices a year.

The Deputy Chief Constable of Police Scotland, Malcolm Graham, told the BBC, “Increases in the involvement of digital devices in investigations mean that demand on digital forensic examinations is higher than ever.

“Current limitations, however, mean the devices of victims, witnesses and suspects can be taken for months at a time, even if it later transpires that there is no worthwhile evidence on them.

“By quickly identifying devices which do and do not contain evidence, we can minimise the intrusion on people’s lives and provide a better service to the public.”

Safeguards and legality

They also claim that there are adequate safeguards in place to prevent abuse of the technology. As well as insisting they cannot store data, a Police Scotland investigating officer must complete an examination request form and justify the need for examining a smartphone before they can use a cyber kiosk.

However, during trials of the devices in Stirling and Edinburgh, the Scottish Parliament’s Justice sub-committee was highly critical of how cyber kiosks were used. They noted that Police Scotland did not tell people their devices were being examined and the police force have admitted substandard practice.

This doesn’t bode well for the full roll-out of the technology, which is expected to be completed by May.

A number of organisations, including the Scottish Human Rights Commission and Privacy International have questioned the legal basis for the use of cyber kiosks. Clare Connelly, of the Faculty of Advocates, has gone even further, arguing that using cyber kiosks is a breach of European Law.

Police Scotland and the Crown Office believe a legal basis exists for the use of cyber kiosks, but it seems almost inevitable that a legal challenge will be made sooner or later. However, it is also likely that the technology could make its way to other parts of the UK soon too.

What to do if Police Scotland want to search your phone

If you are stopped by Police Scotland and asked to hand over your device to be searched with a cyber kiosk, you have the right to ask them to justify the decision first. There has to be a legal basis for searching a device and any examination must be approved before it is carried out.

You should insist that the officers identify what they are looking for and restrict their search to relevant time periods and types of data.

A cyber kiosk can only examine data that is stored on a device or its sim card, so if you want to store data that you wouldn’t want the police to look at, you will need to keep it somewhere else.

Pending any legal challenge, this technology is coming to the streets of Scotland and the online privacy of the Scottish people has been undermined a little bit more.