 I welcome everyone to the 36th meeting of the Justice Committee in 2015. I can ask everyone to switch off mobile phones and other electronic devices. No apologies have been received. I welcome Graham Pearson, who is coming to the session item 1, decision on taking business in private. The committee is invited to consider item 5 and consideration of a work programme in private. Our members agreed that we take this item in private. I am now going to move on to an evidence session on the Interception of Communications by Police Scotland. The session follows a statement from the Interception of Communications Commission on 25 November confirming that Police Scotland had contravened the acquisition and disclosure of communications data code of practice and I will let the witnesses settle in. We have gone to a large agenda today. I welcome our first panel witnesses, Deputy Chief Constable Neil Richardson, designated Deputy for the Chief Constable Police Scotland and John Foley, chief executive of the Scottish Police Authority. I thank you both for making yourselves available at short notice and I go straight to questions from members. I am interested in the history of this matter prior to the publication of the code of practice in March 2015. As I understand it, in October 2014, the then commissioner was asked to constitute an inquiry and to report to the lodging inquiry and then make an inquiry. I would like to make an additional report to Prime Minister about various matters, about the protection of journalistic sources, concerns about that and allegations that the police have misused their powers under chapter 2 of part 1 of REPA. A report was published in February 2015, which covered a three-year period prior to that, in which it was indicated that 19 police forces had sought communications data in relation to 34 investigations into suspected illicit relationships between public officials and journalists. We are Police Scotland, one of those 19 police forces. What was the practice prior to March 2015 in relation to the matter? The reality around the whole set of arrangements for authorising activity in this kind of arena is subject to ongoing guidance and annual checks by IOCO and the OSC, the Office of Surveillance Commissioner, on the other side of the business. Therefore, they rigorously ensure that procedures are being followed and adhered to. In terms of the specific type of authorisation that we are referring to here today, it is fair to say that, in the three years leading on from 2011, the Police Scotland and the Legacy constituent elements of Police Scotland progressed 12 requests relating to this time. The type of activity that is included in that 12 are the five that are subject to the arrangements that led to me attending here today to answer questions. Beyond that, there were seven other applications. From those seven, one was rejected, four were related to Legacy force arrangements and two were related to Police Scotland. Crucially, in all seven of those, they were subject to the normal scrutiny arrangements in place through the arrangements at that time. We are all found to be acceptable within the guidance and the appropriate standards at that point. Are we a bit confused on one matter, which is that you talk about five subject to today. In this report, it was published in February 2015, before the code of practice. It refers to 19 forces and 34 investigations. I am quite sure from the chronology how that can include the five, surely it is the seven. I am sorry, I do not have access to the specific report that you are referring to and I cannot therefore call the two. What I have done in writing to come here today is look at the number relating specifically to Scotland and what I am telling you just now in terms of the 12 is what I believe to be the accurate position. I cannot speak for the rest of the UK in relation to the 19. Can you just talk us through how you would have approached the seven, leave the five aside for the moment, prior to the publication of the code of practice in March. How did you approach? Absolutely. As you would expect, there is a very rigorous set of arrangements to ensure that standards are complied with and that checks and balances are there. So, if there was a reason to progress a request for authorisation in this kind of territory, it must first have filled criteria to ensure that it was proportionate, that it was lawful and that it was necessary. Those are not just throwaway terms, those are specific terms that are part of the kind of gatekeeping process to ensure that it is a legitimate authorisation. Once it is satisfied that in the eyes of the applicant, it then would have been subject to a series of further checks involving people that are trained and specifically deployed within the organisation to offer a view on that and offer their expertise. That would have gone through up to and including a final authorisation. Clearly, the change that has come in as a consequence of the review that you highlight was a specific adjustment relating to protected organisations or professions, which in this case included journalists. That was a significant shift in terms of practice. On the back of that and on the back of the inspector's report, we have put in further checks and balances to make sure that that degree of rigor and scrutiny is at an even higher level. Were those seven authorised by an independent officer not involved in any inquiry? It depends on the level of the authorisation and, of course, the more significant the level of intrusion, the higher the level of authorisation required. At the lower levels, for example, like a subscriber check, that was at a level that, for the purposes of example, may sit at an inspector level, and previously that could have happened within a department that was applying. However, that has now changed and that cannot happen, so there will be no instance where a department or a unit can authorise activity relating to their own request. How much information have you got in relation to the four requests that relate to legacy forces? What happened there? Very little, but this was effectively its national practice. There was very little latitude for individual forces to have their own practices. It would have been a general approach that would be in line with what I am describing, but the important element of this is that all of those have been looked at in terms of normal scrutiny arrangements on an annual basis and have been found to be within the guidance at that time and appropriate standards of assurance were associated with each of them. When the scout of practice was published, what steps did Police Scotland take to familiarise themselves with them to review their practice? On public record, the pace that the guidance came into being was very aggressive and, as a consequence, there is no doubt that that led to a more pressured introduction of those guidelines. As a consequence, perhaps a factor was played in the error that was undoubtedly subsequently made. That said, there was information. The senior responsible officer has a responsibility within their job description to ensure that they provide a liaison function and play a role in ensuring that the guidance that is emanating from the Home Office is appropriately distributed within the force so that people again are aware of the change prior to it coming into being. There is a trail that that did take place. There was a circulation of officers that needed to be aware of the change in the main wear. I can say that, looking at it from my perspective, it is probably fair to say that perhaps it was not as robust a communication process as I might have hoped. That is also a learning point that has been picked up as a consequence of the action. As a result of that, the communication henceforth will be more robust and more structured. However, that is not to say that it did not happen. It did happen prior to it. From my perspective, it perhaps left us a little vulnerable in terms of completeness. Further record, who was that senior officer charged with overseeing this? The SRO is a detective superintendent, Brenda Smith, and she is currently still in place. What went out on the change of the code of practice? What went out to your officers and how did it go out and when? It was a circulation in terms of information that came from the Home Office. There were a few things. One was the guidance itself. Of course, it is quite complicated language in its own right, so it was important that it was supported by explanatory notes. There was a package that I believe was a PowerPoint type briefing pack that came from the Home Office, and that was circulated to appropriate officers. There was training that was subsequently provided. However, that training was not made available until after the applications that are now highlighted by the inspector. What I am saying is that the authorisation was taken prior to the formal training that has been provided. Again, Sarratney-Mae has made the point that the compressed timelines associated with the delivery of the guidelines did undoubtedly cause pressures. I know that the Home Office was asked on more than one occasion for access to appropriate briefing materials, and it was very slow for us to get that information to disseminate. Do you have the timeline? I would need to check the specific date that the email was sent. I do not have that in front of me. I think that it would be useful to have the timeline and then how it was circulated. Was there any response from officers receiving it? We have had evidence before that a plethora of emails went out to officers since Police Scotland. It might have been buried in the... I do not know. I do not know how you highlighted this. It is a very significant change. It is very important to know how it was imparted, when it was imparted, when the training took place and everything to do with the change in the process that is key to these five particular cases. That would be very helpful to the committee. John Swinney. Mr Richardson, I also undertook inspections in 2012 and 2013. Did they voice any criticisms then? I do not have access to the finding. The important part was that the level of adherence with the guidance was at an acceptable level. Undoubtedly, with any inspection report, there is always commentary and areas for improvement training issues. I have no doubt that those reports would have included such material and guidance. The critical part, from an organisation's point of view, is that there were no particular concerns regarding compliance raised by the inspector. Could you ensure that those reports are shared with the committee, please? I need to check the availability of that, but I am happy to have a look at that. If it is possible to share, I am happy to do it. What is the accredited list, Mr Richardson? Accredited list, sorry. Connected with IOCA inspections or authorisation? I am not sure that I understand the question. Does the term accredited list have any currency in what we are discussing that you are aware of? I am not sure. It is not familiar to me as a term. There are people who carry specific responsibilities. I mentioned one of those. If that is what you mean by an accredited list of people who have a key role in that, I understand that. I do not understand an accredited list as a term. How many people who might have accreditation to do certain things have been removed? I would need to check that. Could you share that with the committee, please? Oh, I endeavour to do so. Thank you very much indeed. The June 2014 inspection was the first that was undertaken for the National Sea Counter Corruption Unit. What was the outcome of that? Sorry, are you referring to the IOCA inspection? Yes. The IOCA inspection did not specifically just look at the CCU. With regard to the CCU, what was the outcome? Again, in terms of the report findings, what it has determined is that there were five instances where the guidelines had not been followed. That is an area that is crucially important. Forgive me, chair. I am a bit lost. I think that you were talking about something earlier. I am talking about June 2014. June 2014 was the first inspection carried out of the counter-corruption unit. Sorry, I am talking about the subsequent... No, we were asked about the June 1, 2014. Forgive me, I need to check the detail of that. You would not be aware that there was commentary about the poor record keeping, the poor form standards and a comment that it was a manual system rather than an electronic system that was used. That has all been part of an on-going change. I have given evidence to this committee before in terms of the reform and the necessity to understand that things cannot change overnight. There were plans in place to move to electronic processes that were in train and are now in place. Are you aware of those criticisms? I am aware of those. I do not know the specifics. I cannot recall them specifically, but they were part of a raft of information that led to us making the decisions to improve and make the adjustments within CCU that we have. There has been significant change in both the PSD and the CCU environment. Was I finding that the CCU had committed multiple errors, some of them being the same mistakes repeated? You are referring to a document, I cannot remember the detail of it. I would not challenge if that information was there then you are clearly cited on it better than me. Would you have anticipated you might have been asked about that given the subject matter? That is the point that I think is important to raise. What has surfaced over a number of months now? There are a series of accusations and newspaper headlines that have billed a picture which bears little resemblance to the facts or the reality of this. I know that there is a lot of commentary about the CCU and what it has done and up to and including me as some archetypal villain that is playing fast and loose with the rules. The reality of this is very different and if you will allow me, chair, just to try to highlight what has happened here. At the base of the five cases that are at the heart of all of this, they relate to... I wonder Mr Richardson, I have a series of questions. They are fairly straightforward. A lot of them are closed questions, yes or no. To do with prior to this 2015, are we still against story? I am not unhappy about that. I think that John wants to go through the background which was started by Roderick Campbell and then we will move on to the 2015. I understand that these multiple errors were recorded as one error rather than multiples because if it had been multiple recording that would have looked bad. Are you aware of that at all? Again, you are quoting me details of a report that I do not have at the front of my mind. If the suggestion that that had uncovered blatant breaches of the new journalistic code, would you have knowledge of that? We are referring to the new code, which is the code that is now coming in March. Is that what you mean? I am referring to 2014, if you are saying that. Are you aware of any findings, other than the report giving rise to us being here, that refer to shortcomings with regard to the treatment of journalists? I am not aware of specific breaches with regard to the guidelines as they relate to journalists prior to the IOCU report. No, I am not. You said that there was a tight timeframe. How much notice were you given of those changes? Again, there is a timeline there that has been led in. The report itself or the guidance, should I say, was something that would, under normal circumstances, have involved considerable consultation stakeholder engagement. Usually, the part that enables people to become familiar with the spirit of the change and what the change means in application is linked to that consultation. That is the part where, although Sir Anthony May has set himself, the timeframe associated with that was not allowing the extensive consultation that would normally take place and enabled some of the provisions to be less clear than they should or would have ideally been. Again, I can forward the exact timelines in terms of when the consultation started and finished. I am not saying that there was not a timeline. I am just saying that it was rather shorter than we would have liked. Therefore, we think that, as an impact on our ability to make sure that the officers involved in the authorisation process fully understand the implications of the guidelines. Would that have included information from the College of Policing about the proposed changes? More than likely, yes. Are you able to see who Clark Cousin is? Clark Cousin is the detective chief superintendent who heads up the CCU. It would be helpful for us to hear from Mr Cousin. He would have more specific knowledge on those matters. The force gets downgraded by IOCO in any standing. At any point? I am not sure what you mean by downgraded. Clearly, we either adhere to the guidelines and the principles or we do not. The most recent inspection has indicated that there were five occasions where the guidelines were not properly met. Is that a downgrade? You are the disciplinary authority for Police Scotland. Have you initiated any misconduct proceedings against anyone regarding anything that we are discussing today? No, I haven't. Are you the subject of any criminal or misconduct proceedings? I am not sure that I am the person to be asking around that. The process is that if you were, you would be aware of that. If you are not aware of it, presumably you are not. It is not always the case that I am aware of complaints that are made. There is a due process that has gone through and at some point in that process I may be made aware. I do not want to mislead you here, but it is the police authority that carries responsibility in terms of chief officer conduct matters. I think that that is a question that is perhaps better directed at the police authority. The answer to that question would be yes, but not in connection with the matters that we are discussing today. Has Police Scotland used RIPA on any journalists in relation to identifying their sources? Again, the important part here is that we are subjected to rigorous and detailed investigation and scrutiny by the appropriate... It is one of those close questions. That is a yes or a no one. Well, as ever, it is never quite as simple as that when we are giving the answer. What has been highlighted is that in every instance of where an authorisation has been saw, the inspector has confirmed that that is appropriate in lines with our obligations. There are five instances where that has not been the case. Again, they all relate to the same circumstances that have led to me being asked to come along here today. Beyond that, I think that what I am trying to say to you is that that compliance is assured by a very detailed and rigorous inspection regime and that is an on-going process. The public and yourselves should take confidence from that process that our compliance is at a very high level and where errors are made, that is immediately acted upon and surfaced in a public way to enable the public to have confidence that these very important and sensitive areas of authorisation are appropriately discharged. As deputy chief constable of Police Scotland, do you have the responsibility for ensuring compliance and have you failed in that responsibility? Well, I have never sought to defend a position. The inspector has given us a report following a detailed investigation indicating that there were five instances where the standard was not met. We accept that, we have acted on it, we have corrected it and indeed the inspector has confirmed that he is very content that the actions that have been put into place are effective and appropriate and I believe that he said robust and that they will ensure that a similar failure cannot happen in the future. I think that that is my responsibility. I cannot clearly, I do not think that anybody in Police Scotland can say categorically errors will never happen. It is important though when they do happen that we act on it and try and make sure that they do not happen again. Thank you very much. Is it relating to? It's a very important point on the history. Oh, right. The ICOCO report that we were referring to earlier on, the one that we weren't familiar with, dated February 2015. Are you able to say who in Police Scotland, if any, saw this report and who would have been charged with acting upon it? The ICO report dated February 2015. Which was the precast that took out a practice coming in? Well, again, we have a range of people within the organisation that actively and on a day-to-day basis deal with that activity. So, just because I'm saying I don't have specific, I've not read that detail practicum to hear, please don't infer from that that people in the organisation aren't aware of it. I can clarify that and I can come back to you. OK, thank you. Thank you, convener. After the commission reported to the Prime Minister in July, there were strong rumours that Police Scotland was one of the two organisations that wasn't adhering to the code of practice and in fact was breaking the law. Can you advise what you did, both organisations? This is a question for the SPA, as well as for Police Scotland. What did your organisation do when those allegations surfaced? Well, sorry, John. Do you want to? Yes, thank you. In relation to the allegation surfacing, the authority was first made aware roughly in mid July. Certainly I was advised by the chief constable at that point in time that was happening, as was the former chair was also advised by Police Scotland. At that point in time, we had a view and I think it was a correct view that this was a statutory matter for ICO. They are the body that is responsible for investigating this type of activity. We decided to advise our authority members, which we did, and we subsequently awaited the report being prepared by ICO. Then we invited Her Majesty's Inspectorate of Constabulary to carry out a review on behalf of the authority. That has been accepted. HMIC met ICO yesterday, I believe, and we will look to finalise terms of reference in relation to the review over the next week. I am a bit concerned about that. Police Scotland is accountable to the Scottish Police Authority. I would have thought that, when a serious allegation was made that Police Scotland might have broken the law, the SPA would have been a bit more proactive than that. Yes, I understand your concern in relation to that. However, I must reiterate that ICO is the body that has the statutory responsibility for such investigations. We believe that it was necessary for us to allow ICO to carry out its statutory duties and to prepare a report that the authority will look to have a subsequent review carried out by HMICS. We do not have investigative powers. Did you call in anybody having noticed that, or did you just sit back in its hands and wait for others to deal with it? No. Prior to summer, one authority member had discussions with Police Scotland over some earlier publications from ICO. I certainly had a conversation in mid-July with the chief constable in subsequent conversations after that, as the investigation was progressing. However, we had to allow ICO to carry out its statutory responsibilities. Were those formal discussions with the chief constable? No, they were not. My discussions with the chief constable took place on a regular basis every three or four weeks, so they were not formally recorded. Was that the first SPA that knew that there was an allegation about Police Scotland? Yes. Was that the first you knew of it? Yes. You had not heard any rumours of that before ICO's report came out? In essence, the ICO inspectors came in on 15 June and did their inspection. What happened as a consequence of that inspection is that there was the usual synthesis of what they had learned, and then they made us aware of potential breaches. At that point, Ian Lovingson, the deputy chief constable, with responsibility in that area, had a conversation. That was on 8 July, when we specifically were advised of the potential series of breaches and we initiated a specific piece of work to be done. It was ACC Ruru Nicholson that we tasked to do that. That is the piece of work that generated an immediate action plan to act on the breaches and make changes to ensure that they could not be repeated. The action plan contained some 12 recommendations, 11 have been fully discharged and the final one is in the process of being completed. From that, there were then a series of cascade briefings, and as John Highlights on 15 July, the chair of the authority was fully briefed, as was the cabinet secretary. That may be difficult. Can we see the action plan? I need to confirm with colleagues if there is anything sensitive in that. It would be very useful for the committee because that will tell us the things that were going wrong, presumably, if you have an action plan to remain. It is probably wrong to say that the action plan will show you what has gone wrong, but it will show you a series of further enhancements to ensure that the bar is pushed to a higher level. There are additional levels of checking that have been built into it. As I said, it is a comprehensive action plan that has also been commented on by the inspector, and he has said that it is a very robust set of arrangements. Was that inspection on 15 June unannounced? You knew that they were coming. What notice did you have that IOPO inspector was coming? I need to check the formal arrangements, but for ensuring that the appropriate people are available etc, there is always a lead-in to that. It is fair to say that, contrary to some of the headlines, the breaches, as they have come forward later, were not breaches, as has been described in terms of some kind of glaring emission. Those were errors of interpretation, errors of judgment related to some extremely skilled members of staff that have undoubtedly made an error, but I am not suggesting otherwise. To give the inference, as I know that some of the headlines have done, that this was a complete nutter neglect of the rules that are set out is not an accurate description. Is it still the case that IOPO said that it was reckless? There is an important context associated with that language. There is a necessity, which is again set out in the guidelines, that if there is adverse consequences for anybody because of the activity that has been authorised, it can be determined in one of only two ways. It can be termed as willful, or it can be termed as reckless. The inspector was clear that there is no evidence to suggest any willful element to this, and therefore it only leaves the definition of reckless. That is something that, for you and I, the word reckless is quite an extreme word, and for any member of the public that would read that, it does have a level of concern rightly that would be associated with it. However, it is important to understand that, in the circumstances here, reckless is effectively defined by something that has failed to be done or has not happened, and it was the only consequence that could be reached or the only term that could be used other than willful. I think that that is really important for people to understand, because again the general intuitive understanding of reckless is more extreme. How did you come up with that definition? Where is the definition that you have given us for reckless? Where has that come from? Again, there is no set definition. Yes, you are right. I am sorry, but an omission is a different thing from something that is reckless. I think that the inspector would very carefully choose the words anyway. It is your definition, given the case that this refers to where an investigation into a murder had not been properly undertaken and the inquiries around who had spoken to the journalist. Surely that is willful rather than reckless. The inspector is the person who has gone through the detail of the evidence. They have determined very clearly that there is no willful element to this, and they have defined it as reckless. In the discussions that have taken place, it is clear that, although there is no set definition, there is an interpretation that has been placed on that by the inspector to help us to understand what he means. However, that is information that is not in the public domain and therefore it leaves us in a difficult position. Sorry, the inspector has given you a definition of reckless that is not in the public domain. How do you do that properly? There is a document that I am in receipt of that is not in the public domain that gives more clarity. It will be very useful to the committee that would give us more clarity to see that document. Unfortunately, I am not in a position to share that. Who is in a position to share it? Again, it would need to be the source, which is IOCOR. Excuse me a minute. Has IOCOR said on that document that it is for your eyes and your eyes only? It contains information that would potentially compromise subsequent proceedings and as a result it would be inappropriate to have that in the public domain. I am a bit lost here. Subsequent proceedings, what are we talking about? There may be, as I said in terms of the process, the inspector has determined that some individuals have been adversely affected as a result of the authorisation. There are no live proceedings now, there is nothing that is subduity. No, but there is another stage of a process that might very well be taking place, which is an IPT and therefore we need to be cautious that we do not compromise that. I think that we wish to press you on this because, as you have given us a definition of reckless that the IOCOR has shared with you but is not being shared with us, I do not think that we have been in your duty to the public and to this Parliament not to see that document one way or another. So I think that when we come later to discuss this, the committee may very well want to decide how to proceed with that. Sorry. I have failed to understand how the definition of a word could be subduity or could not be released to the general public. I mean surely the dictionaries provide definitions of words, there is a definition of reckless which is not like the current understanding of the term of the word. I do not really see how that can be very difficult to release that. Finally, you said that the Home Office was slow in releasing information about the changes in requirements. When did you both become aware that there was a change in the requirements and what degree of responsibility did you think you had to ensure that that was complied with? Again, just to rehearse what I said previously, there are arrangements in place within Police Scotland to ensure that not just this but any change in operating arrangements, the law or policy and practice are appropriately communicated and where there is implications through training or anything else, they are managed. In our case that is the SRO's responsibility and the SRO has indeed done exactly that. Whether I am saying that the Home Office was slow, I think that that is a consequence of the compressed timeline that the guidelines were drawn up and then implemented. I am quite certain that the Home Office was under pressure to develop these guidelines, it is just a consequence of the whole picture. Have you seen the document that defines Reckless and so on? We have not seen the document. Our understanding of the legislation and we have had it disconfirmed by the commissioner is that the commissioner deals solely with chief constables, that is where the relationship lies throughout the UK. Therefore, we will seek assurance from the incoming chief constable, Philip Gornley, that the SPA will have sight of that document once he is in post and we will review it at that point in time. Clearly, we have asked HMICS to carry out a review as well but we will be making our own determinations once we have sight of the document. The commissioner is not in a position to share it with the authority. HMICS, then they must have to get in sight of this so-called document that defines Reckless if they are doing an inspection, is that correct? I would imagine, yes indeed. You are sharing it with other people, you are sharing it with the SPA eventually and HMICS. I cannot see why it is not going to be shared with the parliamentary committee. We will pursue that. Alison, please. The terms willful and reckless are there because breaches of privacy in this kind of area are so significant. I understand that Mr Richardson's desire to minimise the damage of the language, but the language is there because, as I say, these are significant breaches. Can I return to what the SPA said? You said that you did nothing for four months after you learned in mid-July that there were these concerns. In your conversations with the chief constable you did not discuss what arrangements were being put in place to prevent further breaches for those four months? No, that is not quite accurate. One of the authority members raised the matter to our August board meeting with the chief constable and asked for comment, but as it was subject of the on-going investigation, the response was almost that, that it was subject to investigation and would be reported back in due course. We did not have been appropriate for you or the board members to say, well, let's set aside that particular investigation, but this raises general issues for Police Scotland. What are you doing with that? Given that this was the first time that we had encountered this situation, we had to get a determination of exactly what our powers were in relation to it and the powers of the commissioner. We took a decision based on that, that we would wait upon the commissioner's investigation and the findings. At that point in time, regardless of the outcome, we would look to ask HMICS to carry out a review and we would look to have a copy of the report where we could make our own determinations upon. The legislation would appear to suggest, as I said earlier, that the commissioner deals solely with chief constables. It is then up to the chief constable to determine whether he or she releases that information to an authority or a commissioner. I personally would not envisage a chief constable or chief constable saying, no, we're not going to share it with you, but if that were to be the case, then we would have to look at that in a different light. Mr Richardson, you said in response to Mr Finnie that there were no officers from Police Scotland's counter-corruption unit going through misconduct proceedings as a result of breaching that code. Is that correct? At this stage, that's correct. Short of that, what have you done in terms of trying to establish why those breaches occurred in this particular instance? You said all five related to one case. Can you tell us what you did short of misconduct proceedings? The context of this is critically important, and if you'll allow me. Basically what we're dealing with here is information that has breached out of a live murder inquiry. That is very concerning and potentially was compromising the flow of justice and potentially would compromise that murder inquiry. As a result of that, it would have been a neglective duty had we not taken steps to try and do something about that. That information was first identified and surfaced by officers involved in the murder inquiry, and they referred that to the CCU. The CCU were effectively asked to do a piece of work to try and determine the problem and whether or not somebody within the murder inquiry had in fact broken the law. That's in line with CCU responsibilities. That's kind of how they operate and that's what they do. They, as part of that investigation, proposed a course of action that included the authorisations that now are subject to the concerns, but they did not self-direct that, but instead passed that authorisation outwith again to another part of the business to go through the appropriate checking process associated with the guidelines and appropriate authorisation. The officer, certainly at the more significant level of authorisation, did a significant piece of work and tried to apply the new regulations as he understood them. He's a very experienced officer that's been involved in this business for more than a decade. He's also signed off on more than two and a half thousand authorisations in various ways. He's part of a department that has been commended for the last two years by the Office of Civilians Commissioners during the annual inspections. This is an extremely experienced officer that tried his level best to apply the regulations and what was required of him and, in so doing, misinterpreted the requirement and allowed the authorisations to go ahead, which subsequently was identified by the inspectors as being wrong. That is the reality of what's happened here. The CCU were effectively people that were simply trying to take forward a requirement that came from another part of the business and was authorised in another part of the business. So the kind of notion that the CCU are running amok here doing inappropriate action just simply isn't accurate. I've not made any suggestion that anybody is running amok. Can you tell us the rank and the position of the person who signed off the authorisations? There were five authorisations and three of them. They were asking for different types of activity. The more significant parts of the activity were signed off by a detective superintendent, and that's the individual that I'm referring to just now. The two of the lesser or lower significance authorisations were signed off by a detective inspector. You said earlier that the checks and balances and the sign-offs were outwith the CCU, but the findings were that two of them were within the organisation. That process is part of the action requirements now changed, but for the lower two that were signed off by the detective inspector, that's correct. That was a detective inspector that was within the CCU, but again I would stress that that was a practice that was acceptable, had previously been looked at by the inspectors and there were no issues raised with that. What we have now done in relation to this inspection has raised the bar and basically made it more significant by ensuring that there is now no possibility that there can be any internal authorisations that will now all be independent and external. You've said that this was about a murder case. It would have then been of some significance and some concern within senior members of the organisation that youth perhaps had someone who was leaking information, is that right? Correct. Who within the senior management of police knew about this and why? Were you not extra careful about the sign-offs for this given that it was such an important case? The suggestion that we've not been careful is not accurate. What I've described to you is a very rigorous and robust set of arrangements and they were applied in this instance. It just so happens that the officer concerned has misinterpreted brand new legislation that at the point that he was asked to do this was 22 days old and there had been only a very rapid introduction with limited opportunity for training. The officer himself had had documentation to read but had not received the actual training course associated with the new guidelines and the change. Again, I don't seem to minimise this. A mistake was made but the context of the mistake is really important. This is an officer that was trying his best to do his professional duty and has made an error of judgement. I think that you do seek to minimise it but we have to rely on what the commissioner has said which was that it was not proportionate, it was not lawful, not necessary and it was there for reckless. That's what the ruling concluded. If your officer was aware that there was new guidelines but he was not completely o-fave with them, would you not have expected him to perhaps pause and consider that particularly given that it was relating to journalist sources? What I am suggesting to you and I have taken time to speak to the individual concerned and I have read all the associated documentation. I am comfortable that he did take a pause. He did try and do his level best to ensure that the guidelines on the change had been applied. He did and has a considerable background and credibility with authorisation activity that has been recognised, as I have said, on two successive years by the OSC. That is not an officer that has simply thrown caution to the wind and neglected his duties. Nothing could be further from the truth. What he has done is that he has made a misjudgment with regard to 22-day-old legislation that has led to the inspector's finding that he has authorised activity that should not have been authorised in that way. That is the detective superintendent. What is his name again? David Donaldson. You have made quite a lot of the fact that the legislation was new and that the guidelines were new. It was very high profile because it resulted from concerns about accessing journalist sources. There was a lot of public awareness of the new guidelines. That was obviously Westminster legislation. I am surprised again that Police Scotland did not manage to implement that when many other police forces did. One of the things was that the worst detective superintendent Donaldson was involved in the murder inquiry. He is completely independent of it. Perhaps just a final point on that. Seek advice from his senior officer, or did he make the ruling on his own without any further? I would need to clarify that specific point, although in normal course those are the force experts and those are the people who would advise senior officers. The area of technical expertise associated with this entire area of business is extremely high, it is technical, it is complicated and the stakes are extremely high. That is the reason that we treat it so seriously and that there is such a high level of checks and balances put in here. That is why I simply cannot accept your point with regard to what is implied as a neglect in relation to practice. It is not. What has happened here is a misinterpretation of new legislation. The checks and balances clearly did not work. The law was breached because judicial approval was not sought, obviously. Has Police Scotland sought judicial approval for any other applications relating to journalism since the new rules came in in March? Margaret Mitchell, please. Just to press you a little bit on that point, ACC Richardson, it says in the IOCC report that the two applications had been approved by the designated person that was not independent of the investigation. Is there a conflict of interest test that is always supplied with any internal investigation or any investigation? We have now changed that. We have introduced a level of complete independence, but prior to that, that was accepted practice. That was how the business was conducted, it was inspected and found to be acceptable by those that regulate us. That will not be unique to Police Scotland. That will be across the UK. On the back of this learning experience, we have pushed the bar yet higher again, and that will hopefully ensure a higher level of comfort in that particular area. Prior to that, it was the way that the business was done. On that level of authorisation, we are talking about a subscriber check. Do you think that that is exactly the case with a subscriber check? If we have, for the sake of argument, somebody in Police Scotland that has a mobile telephone and we know that that telephone has contacted a number of telephone numbers, a subscriber check would be to say, from this telephone number, who does that belong to? That is a subscriber check. That is effectively the two authorisations that we are referring to here. It is exactly that. It is trying to identify, from a known number, who owns that number. That feels more apprehension because it seems to me in any organisation, especially if it is internally, that you are investigating something right up there at the very top of that investigation. Is there any possible conflict of interest? I would have thought that that was just good practice. Before we were looking at smoking mirrors, about 22-day-old new code of practice guidelines that someone could not interpret, is that not a fair comment? I come back to my point. That was the practice, that is the way that the business was conducted and has now changed. That is exactly the minute market. This is the detective inspector level, when we called it lower level subscriber. Were they involved in any way in the case, in this murder case? Not in the murder case, no. They were not involved in this fight. How can the IOCC say that there was a conflict of interest? Where does that come into this? Investigating officers connected to this case, they were not at all. The DIs that allowed permitted subscriber checks, they were not in any way connected to this reopened investigation into the murder. What I described is that we have a category of murder, a live murder case, and in the progress of that officers involved in that inquiry identify that a potential breach has taken place where information that should have been contained within that environment had been made available out with. They then raised that and referred it to a separate part of the business, which is the CCU, which is there effectively to take care of a range of things, including in this particular instance, internal investigations of criminality. They were charged with that and were progressing that inquiry to try and find out where that breach within the murder team had taken place. The person that we are talking about just now was part of that CCU activity. Can we have that person's name in fairness to having had DS Donaldson? Who was that? I forgot her surname. I'll come back to you on that. Perhaps if we could go back to the necessity and proportionate statutory tests, why was it thought that it was necessary and proportionate? That's been found to be contravened to the extent that it's been termed reckless, albeit under your definition. Why was it thought that it was proportionate and necessary? In essence, the issue relates to the information connected to a journalist. The breach was understood in the circumstances. The breach has happened within a murder inquiry, presumably emanating from a serving police officer. The operating view was that that information had been provided to somebody on the outside of the organisation who was in fact a retired police officer. At some stage, subsequent to that, it clearly has been given to a journalist at some stage because the information ended up in the newspapers. The focus initially of the consideration was that it was not intended to look at a journalist or identify a journalist. It was focused on trying to find out who had breached their responsibilities within the murder team. That focus was quite narrow. The guidelines, as they have subsequently been identified by the inspector, indicated that, if it subsequently became a journalist source at whatever stage, that must be considered and therefore taken into account. That is the fundamental difference. In terms of proportionality and necessity, that was considered and looked at and deemed to be at the right level. However, it was taken too narrow a consideration of ultimately when it became the information of a journalist. As a consequence, that is what the inspector has highlighted and therefore led to the inevitable conclusion that it was either willful or necklace and it was not willful, therefore, it had to be a necklace. In other words, it was a breach of article 10, which is the freedom of expression. You were not just focusing on this person that had leaked the information. All consideration of who else this might be affecting was not taken into account. That is ultimately the substance of the new regulations. Article 8 and article 10 are core considerations. Ultimately, the new guidelines indicate that protected professions need to be far closer to the front of our thinking. That is where the misjudgment has taken place. In your evidence today, when we have been asking quite reasonable questions, you have continually referred to newspaper headings. It seems to me that there is quite a lot of resentment from you to some of those newspaper headings. Did that cloud the judgment, therefore, that article 10 was breached freedom of expression? No, what I am trying to explain is a context. I understand all that. I have the context and what was overlooked with article 10, the fact that it would involve perhaps looking and identifying a journalist when you were focusing quite clearly on this individual who had leaked some information. You did not take into account the effect that it might have on the freedom of expression under article 10 affecting journalists. I ask you that because, on a number of occasions today, you have, if you like, had to go at the press. No, what I am trying to suggest is that the journalistic element was separate in the initial thinking and consideration, not separate, but it was so far removed or distant that the consideration was in a different place. That has subsequently been found to be not correct and therefore changes have taken place to ensure that that does not happen again. I am not suggesting that somehow we have neglected or been driven by concerns about headlines. What I am trying to simply say is that, as this has played out, there has been a continued series of headlines that have happened at a time where, because the investigation was still on going, we have not been in a position to provide any context or commentary to that, which in a sense has kind of fuelled the concern and led to a position where I am quite sure that the public are being led to believe that there are levels of activity associated with this that have not actually happened. I think that we have got all that easy, Richardson, but it seems to me that I am only coming to this now, looking at those papers. If I were looking at those papers and being asked to implement it, two things would be crystal clear to me. One, I have got to look at the source that I am seeking information about. Two, I have got to look at the possible collateral damage. Who else would be affected by this that we did not intend to pursue? It seems to me that there was a willful neglect or a huge neglect of that being reckless if not willful. I think that that concludes my… I am going to take Margaret MacDougall next, who has not been in, and I have got my glasses on, then I have got Gil, then John, then Rod. I would like to come back to you. I beg your pardon. I will take you after Margaret. I did not know that you are not on my list, but we are slipping up a little. Thank you. Good morning. Who has responsibility within Police Scotland for ensuring that the designated persons referred to in the commissioner's report were made aware of the new code of practice and the requirement to seek judicial approval? Who is responsible for that? The SRO that I have mentioned previously, the Senior Responsible Officer, Brenda Smith, the Detective Superintendent, who is the liaison point and acts as a conduit with the Home Office for Information. Did Detective Superintendent Donaldson seek advice from the SRO? There would have been communication there because the SRO is the one that has forwarded it. I have said previously that I would need to check with David Donaldson to find out exactly who he spoke to, but I would not expect that he is the person who is the force expert. He is the person that would effectively advise others, so I would be expecting him to read the guidance, the legislation and be able to, using his experience, determine exactly what that means in terms of practice. For my sake, because I am not into the technical jargon, judicial approval, what does that mean? It means that it has to be looked at and considered by a judge. Is that not clear in the code of practice? I am not sure that I understand. The code of practice says that it requires judicial approval. I have explained that what has happened in terms of the five breaches is that active and fulsome consideration was given. The line that was taken by the officer formed a view that this did not involve journalists or it was so far removed that it did not require the judicial approval as set out in the guidelines. As a consequence, he felt now erroneously that it was acceptable for him to authorise the activity without that step being taken. The inspector's report has highlighted that that was a narrative judgment. He should have considered it as being a journalistic source and therefore it should have gone through the process to ask for and seek judicial approval. That is exactly the heart of the issue. As I said, as a layperson, it seems clear to me that journalists were saying that the intercept of communication between them presumed a member of the police force with a journalist. Was that not clear to the detective? The focus, as I said previously, was that there was a breach from a murder inquiry involving a police officer to a retired police officer. The focus was on the serving officer within the murder squad so that journalists were further down the stream. The initial consideration formed the view that it therefore did not apply that we required judicial approval. That has subsequently been highlighted as being incorrect, but at the time that was a judgment that was reached by an experienced individual that did his best to apply the changed legislation to the circumstances presented and formed a view. The fact that that information was finished up in the papers means that it must have got to a journalist. That did not occur to this detective superintendent. That is something that has now been taken account of. The inspector has said that that is something that needs to be taken account of and that we have taken the necessary steps. What training was given to the detective superintendent, Donaldson? He had no training, he only had the legislation in front of him. To me, he clearly says that judicial approval was required, but he did not pick up the fact that it was in the papers that there were no journalists involved. He did not pick that up. Are you referring to what training he has had specifically around the guidelines or in general? Yes, on the code of practice. You are an expert. As I mentioned before, he received training, but that was after the authorisation was sought and taken. Prior to that, he had received the guidelines, as I highlighted earlier on, that came via the SRO that was available. It was written documentation, there was a presentation, he had to interpret that, which he did to try and inform his decision making process. On this occasion, he has misjudged that. Thank you very much. First of all, I would like to go back to the timeline and I would like to check with you what you should say. In fact, you said that the change in the law was enacted on the 25th of March, and 22 days later, the CCU made the request. Now, between this period of time and the 15th of June, you said repeatedly and you just said that the person in charge received later on some training. So, Alan Bell must have been ringing at that point, that what has been done was not, was an awful, was not, was not compared to the new legislation, in front of the new legislation, was not permissible. What happened between that time that he got the clarification and the training that what he had just done was not awful? What happened between that time and the time that the IO co-co started the investigation? Well, as I say, there was active consideration by this officer and he was content at that time and subsequently that his judgment was accurate. The training didn't adjust that position and it was when the inspection took place on the 15th of June that they picked up on these authorisations and then, of course, there was subsequent conversation, but up until that point, the authorising officer was comfortable that his decision was appropriate. Then it's wrong. It has to be wrong because you said early on that it could have not known when he took that action because he didn't receive proper training. That training arrived and was there before IO co-co became involved. Therefore, he should have realised his mistake. If he had not received a mistake, the point of him having been training before or after he took the decision is pointless. Again, this is not a straightforward issue and it is hugely technical. What Sir Anthony May has conceded is that the guidance that came out even within the training could have been clearer. As a consequence, in terms of the considerations notwithstanding the training, the detective superintendent that we are talking about had applied a rationale and an approach to his decision making, which he believed to be in line with the guidance and correct. That's a different view from the inspectors. Again, it's a view that we now accept and we've taken action accordingly. At the time, the officer was trying to do his level best to live within the changes and the law and do his job. It's just subsequently been determined that that clearly was not correct. Even when you received appropriate training and all the guidance that was available, which you asked for it to be available before when you took the decision, you think that it's quite logical that it still fought not to flag it up? What I'm saying to you is that he was trying to do his job and he was applying an approach that he thought was correct. With hindsight looking back to try to suggest that he should have known things, I don't think that that's appropriate. I'm just trying to say how much guidance and how much do you need and how much training does one need to understand what the mistake has been done. As ever, reading a direction particularly on matters of law that are at times incredibly complicated is not enough. What has been acknowledged by all parties here is that it's through the engagement and the consultation that takes place normally on the lead-up to the change that people understand and have an opportunity to engage and test their thinking. That, on this occasion, for various reasons and time pressures has not happened to the extent that it should have done. That's led to a position where people are not as familiar with the spirit of the regulations or the guidance as they perhaps should have been. But again, I'm rehearsing the same answers. I know, but we're trying to understand when did this inspector go to the training available to him would have been available before June. So there'll be at least a month or two months for him to justify what he had done. Because you said that earlier, you said that the timeline was too short for inspectors to understand what was required by the legislation, but you didn't give us a timeline. Why do you think it's long enough? Christian, I've asked for that in detail. I've asked for a timeline in detail. I would like to know what you think it's long enough before the time of the direction of the legislation for train to take place for you to be confident that inspectors will have time to take on that legislation on board. Is it a matter of month or a matter of year? It's impossible to answer a question like that. Ultimately, what needs to take place is appropriate consultation to give people an opportunity to engage. What's happened here is that a training course was provided and the director of superintendent that we're talking about received it on 6 May. 6 May is some considerable time after the guidelines have been in place and after a point where he's been asked to take a decision on authorities. That's clearly not a satisfactory situation. Do you think that between 6 May and 15 June it's not long enough for him to flag it up to yourself? That's not a question about training. I think that we'll move on if you don't think that. No, if I can keep going. Well, let's hear what it is first. Yes, please. I would like to come back into... We talked about training. I would like to go back to a letter that has been sent to you, Mr Foley, from Mr Anwar. I wanted to know if you wanted to make any comments on that, what we are discussing this morning. I have been in the seat of a letter from Mr Anwar and I don't feel it would be appropriate to discuss it this morning. It's a legal situation, Mr Anwar, as a solicitor. So you received a letter, Mr... Yes. We've written it as one. I'm quite happy for you. We know what it's it, but it's well. Well, clearly Mr Anwar is representing clients and I will be considering Mr Anwar's letter that I have yet to respond to him, so I will need to review the contents of his letter, carry out a review and then respond to Mr Anwar. I don't believe it would be appropriate to comment at the committee prior to having formulated a reply to Mr Anwar. First of all, my members, we've not replied yet. We've yet to discuss what we're going to do with that letter. A last question, if I may. Yes, it's your holding back, Gil, but it's not my problem. You're sitting next to him. You said early on that you thought that that leak, with this reopening of the murder inquiry, that that leak from one of the officers to a journalist could be a breach of the law, so it should be investigated. Do you think that the new arrangements, the change of legislation, will stop for Scotland to do this kind of investigation? No, I mean, ultimately we would be duty bound to investigate any serious criminality and if we believe that a crime is taking place then we will investigate that. The issue in relation to the guidelines is the manner in which and the seniority I suppose in terms of authorities. So there is nothing in the guidelines that dictate that we cannot now take the necessary steps to investigate anything that requires to be investigated. We just have to go through further checks and balances to make sure that it is completely compliant and in line with the law. Do you think that if you had asked for a request for it to happen, it would have been approved? Let's move on, I think. I'm going to move on, Christian. Gil, followed by... Now, I've got John and Rodd unless and I know you, but we're itching to ask short supplementaries, those who've been in, but Gil, this is your first time. Yeah, mine's not going to be supplementary because most of the stuff I thought my good friend and I was elbowing him. Yes, well, elbowing him in French next time. I was just wondering who or what was pushing the timeline, who was responsible for that. Was it the actual, because it was in legislation now, or was something other pressure on you to get signs going? I also don't know the answer to that. It's a reserved matter, there have all been a series of pressures but I'm honestly not in a position to do it. But you said that it was, I think, matters would be rushed. Is there a way that Police Scotland could have asked for more time so that training could take place? Is it because it's now in legislation? That was what was pushing you to rush on? No, I don't think that Police Scotland could have done anything to adjust that general position. There's a national change that takes place. Police Scotland were asking questions about information to enable training to take place, et cetera, but again, I'm not criticising. I know a number of colleagues, including those from the Home Office, were under pressure here. Nobody was being deliberately obstructive. It was just rather pressured for all concerned. I think that that's a position that's been well recognised by the various parties, including Sir Anthony May. Does that notion of pressure come with hindsight because of what's happened or was the envelope too short? I think that it's fairly clear looking at it now and it's more stark when you look at it with hindsight that to receive a training course several weeks after the guidelines have been implemented is far from ideal. The ideal course would be to ensure that an appropriate lead-in took place, that individuals were trained and ready to properly apply the guidelines prior to going live, but I suppose that we don't live in an ideal world and that certainly hasn't happened here. If that time hadn't been available and I know that you said that it is very complicated, could it still have happened because of the complications or was that too much to ask you to answer? I mean, could it still have happened? Yes, it could have done. The reality here is that it's about interpretation and application and the officer concerned has never sought to suggest that he, to avoid the criticism, he's effectively acknowledged that this was an error on his part. Without rehearsing what I've said already, it's an officer that I believe was trying his level best to do his job and apply the regulations. He's just made a mistake. My last point is that you may have actually said this but I don't know if I understood the answer quite correctly. When did Police Scotland take remedial action? When did you take that? After the inspection left, there was a period for them to pull together the report and we were advised on and around 8 July. It was on that day that Ian Livingston and I had a conversation and we tasked Rory Nicholson with a piece of work, which led to 12 recommendations being made and some immediate measures to ensure that there was a separation, that there was a deputy chief constable that was involved in the process around article 8 and 10 and a number of others. As I said, of those 12, 11 are now fully discharged and one relating to the judicial process is currently under way. We're aware of the publicity and we're concerned that it would compromise a live murder inquiry. What did you do with the publicity? I mean, there was a series of requests coming in to make comment on the circumstances and we were unable to make comment on the circumstances largely because the inspection report had not been published. There was a half-yearly report that came out from my own. The publicity about the conduct of a live murder inquiry, you said earlier, concerned you. Yes. What did you do about it? As I said, there was a referral from the murder team to CCU and there were… Did you speak to the murder team? No, I wouldn't routinely do that. We have mechanisms within the organisation. Ian Livingston and I had a conversation about the circumstances but, again, the CCU were charged with a piece of work to try and find out what the issues were. Did you speak to the CCU? Well, I speak to the CCU regularly. They work under my… Mr Itchin, I'm trying to establish… I mean, is it your position that, whilst being aware of this, this was left to a DI to initiate all of this that results in us having this discussion today? Or did you have personal direct knowledge of what was happening as a result of that publicity and the action that some of your subordinates took? I clearly had awareness of what was happening here. We have checks and balances and mechanisms within the organisation, which I'm describing to you, to ensure that rules are followed and processes are followed. They were initiated. If I was to jump in, that would present risk in its own right. I have not done that in this instance. What were you aware of? At what point? What do you mean? I read the headline the same as everybody else. Yes, and clearly the concern here. I hope that, like everyone else, you'll see there's an important role for the press in any liberal democracy to scrutinise. Our job is to scrutinise and understand what you did. You were aware the DI raised this issue? I don't understand the question. The DI raised which issue? The issue of seeking to establish the source of this information. You've told us that you were concerned about publicity and how that may impact on a live murder inquiry. You say that you have oversight but you are saying that you didn't have direct involvement and how that was responded to by Police Scotland. Is that your position? What I'm suggesting to you is that on a day-to-day basis the CCU carries responsibility for a national organisation and has a range of investigations that are being conducted. I do not get into the detail of each of those investigations on a day-to-day basis. That's what I've got a detective chief superintendent heading the unit to do and I will receive updates in accordance with practice and if there are any issues that need to be brought to my attention they are. When did you receive an update on that publicity? We received updates on the publicity on a day-to-day basis relating to the media coverage. I meet with the CCU usually about twice a week. There would have been routine reporting but I can't give you a specific date in relation to... Roughly when would you have heard of how Police Scotland were responding to that publicity? Police Scotland were not responding to publicity because last time we were not in a position to do so. I mean the responding and seeking to establish the sources. That's an entirely secret thing. I don't know if I'm not making myself clear here. I think that what we're trying to get out is that here's newspapers running stories that a murder case has been mishandled and that there are almost quotes of cover-up and you see things in the paper. This isn't just any old thing that's happened that's been brought to light in the paper on the headlines. A high-profile murder case, mishandling of it, a bit of a cover-up about not having handled the investigation properly and something. This is all going on and then you find out surely you're going who the hell is putting this to the papers? Let's find out. So what did you do? I mean I would imagine the top of the tree was shaking at the time to find out. That's what your point is, John, isn't it? What did you do when you saw this? Who did you speak to in order to say where's this all coming from? So there are two separate things here and I think that the distinction is important. There is general coverage in relation to murder inquiry. The Lord Advocate... No, no. This is this case, this particular case. Yeah, that's what I'm talking about. So ultimately the bit that was the focus in relation to the referral to the CCU and then that subsequent inquiry related not to the generalities of the murder investigation and all of that associativity, it related to a specific concern that information had breached from the murder team out with the confines of Police Scotland. Let me stop you there. When did you become aware of that, please? If it means you have to go and consult notes and come back to us, we would understand that because you're clearly a busy man, but when did you become aware of that? I'll refer back and identify from a timeline and include it in the follow-up correspondence that you're looking for. You can understand as a police officer why that's important. It's when you have personal knowledge of the events giving rise to us being here. Is that what you did following that, if anything? Okay, I'll come back to you. Okay, thank you very much. Can I just one final point then? Is it your position, Mr Richard? Is criticism of any live inquiry going to be seen always as compromising inquiry or is there a role for the press in articulating public concerns about a police inquiry? I draw a distinction between the two. The press are clearly entitled and have a role to play around making the public aware on a whole range of things, including a degree of scrutiny over public bodies. That's absolutely appropriate and acceptable. The bit that my focus would be on is if individuals within Police Scotland have broken the law and have breached their responsibilities as serving officers. That is something that I would expect the public would demand that we do address. That's the focus here as far as the CCU inquiry is concerned. Yes, absolutely. I could not agree with you more. You'll therefore understand my astonishment that the person charged with discipline in the force, the Deputy Chief Constable for Discipline, is unable to tell us how he responded to this matter, which caused him great concern. First, I welcome your coming back with your notes. I would have thought that you would have said that I was aware of the DI, that the CCU did that, that I became aware of that and that this is where it went, rather than a lecture yet again in process. This isn't about process, this is about your personal knowledge of it as the individual in charge. I have answered a series of questions that I have given you a candid overview of my appreciation of this and how it has come to light. You are asking me questions now that I am perhaps just not reading, but I think that I have answered all of that. There is publicity that could constitute a crime or misconduct. As the disciplinary authority, are you not proactive on that, or are you just waiting to see how things unfold? The public's anticipation would be that there is something wrong here and I need to find out what is happening. I don't give you the various subordinates that will come to you with information, but it's inconceivable that you have no involvement in this until we get away down the line where someone analyses how you've gone about your processes and referred to it as being reckless. Let's separate the media coverage entirely from this. What I have said is that when it became apparent to the officers within the murder inquiry that something had taken place that potentially constituted a crime, they referred that to the CCU. The CCU then did some assessment of that and then determined that they needed a progressive inquiry. I'm getting to that. What would have happened at that point is the CCU, at the point where they felt that they had something they needed to investigate, would have updated me in terms of normal practice. I can't give you the date that that initially happened, but I can try to find out. With many questions that we wish to pursue, I can advise the committee in our work programme and doubt that they will have a whole list of questions, perhaps some of which we will have to peruse once we've looked at the official report to flesh out more information. Alison Johnstone has raised three points that I want to further explore. Did you find a leak? That's again information that I don't want to be obstructive. I don't think that I can make comment on that due to the potential subsequent activities of IPT. If you have found a leak, is that compromised by the action that you might be able to take? Has that been compromised by the police Scotland's own breaches of the legislation? I don't believe that there's a compromise there now. The Emma Caldwell case collapsed, am I right, in 2007, but you've spoken about a live murder inquiry. Can you give us some more information about how active that was? In effect, any undetected murder—the Emma Caldwell inquiry was—we categorise investigations, and this was the highest level of category A murder, and so the number of people that are associated with the inquiry is the highest possible level. An undetected crime at that level is never shut down. It remains live all the way through. Ultimately, even when lines of inquiry have dried up, what happens with the passage of time because of advances in forensic opportunity, advances in a whole series of things? There are constant reviews that take place to see if there are any new lines of inquiry that emerge that would enable further progress to be made. On that particular set of circumstances, it has remained live all the way through. Reviews have systematically taken place, and on 25 May, the Lord Advocate instructed that that was escalated up to a full category A approach, and therefore appropriate resourcing was put around it. That's the chronology in sequence. If it was already a category A, how could it be raised any higher? In effect, because if you're into the review phase, what happens is that that sits. It's still a live inquiry, and it's still a category A, but because the inquiry lines have dried up, it goes into the ownership of a team that does that constant review. Is that the point where, either because of something that they've found in review or, in this instance, when the Lord Advocate has said that he's looking to take it to the next level, we take it back out of that unit that deals with the review and resource it accordingly so that, effectively, you have more asset available to do hands-on work? At the time that you were investigating what you thought was a leak, was it after the Lord Advocate had instructed that resources were put to it, or was it prior to that, when it was in that sort of review process that had obviously been in since 2007? Sorry, I'll need to check that and come back to you. If you could, that would be great. Finally, convener, if you indulge me, you said earlier that it was only a subscriber check. Subscriber checks are phone records on time and location, is that right? Who people are talking to, where they were, when they did it and how often they're doing it, is that correct? No, a subscriber check is simply the owner, the details relating to a telephone number. There's no information provided with who they're speaking to or any additional information. How often that person was contacted? No, a subscriber check is simply who does that telephone number belong to. Can I ask further to the letter from the PF? Can we see that letter? Is that the public domain as well? The letter of the 25th of May was asking you to escalate the inquiry up, the murder inquiry further. I didn't mention a letter, I simply said that the Lord Advocate asked for that process. It may well be that there's a letter, I'm not sure what you need to check. It's useful to know what prompted the Lord Advocate, apart from various other things, whether it was to do with press reports, how that came about into the system that made the police look again at this case, not just the usual reviews of unsolved cases. Rod, you're the last. A couple of points. Just about on this question of judicial authorisation, the code of practice requires it for communications, data applications to determine journalistic sources, and sets out three bullet points in the next bit of information that could be used to determine journalistic sources, including data relating to journalist communication addresses, communication addresses of those persons suspected to be a source, and communication addresses of persons suspected to be acting as intermediaries between the journalist and the suspected source. There's quite a lot of detail available to you. Are you still saying that Detective Superintendent Donaldson gave full regard to that? I can only say what I've already said. As far as I'm concerned, he has given appropriate consideration as he saw fit to do his job and adhere to the guidelines. It's subsequently been determined that that was incomplete and incorrect. I can't say any more. The question of requiring judicial authorisation, put that in context, was that a one-off, or are there other forms of application, not necessarily this, which would require judicial authorisation, which Detective Superintendent Donaldson might have been familiar with, or is it really a one-off? I'm not sure I understand what you're asking me. Basically, would detectives pretend to also be used to having to get judicial authorisation for other, not necessarily this kind of journalistic source but other kind of application? He's very familiar with the rigours of authorisation that, in different ways, require different standards. I've said that, since this has happened with the specific regard to journalistic protective professions, there have been no requests. That's not something that's happening on a day-to-day basis. Largely, he is familiar with the necessity of applying legislation into a decision-making process. That's his profession. That's what he does. On the other hand, he's tried his level best to do that appropriately. Thank you very much for giving your evidence this morning. As I advised, the committee will consider its next steps in relation to this matter later today. I'll give you a suspension to 11.30 if you're content with that. That was a long session. Before we move on to the second panel with regard to iOKO, because we've taken so long, quite rightly, over the first panel of witnesses, I'm suggesting that we take item 3, Abusive Haven and Sexual Harms Scotland Bill. The following we do in the first week back will give us a proper attempt on real questions. There's a lot we want to ask in that. That would be the best way forward. I'm advised that the cabinet secretary will be available to do it. I welcome Michael Matheson, Cabinet Secretary for Justice, Scottish Government officials from Police Division, Ian Kernehan and Graham Wall. Cabinet secretary, you wish to make an opening statement. I like the sound of that. Good morning, Cabinet secretary. Can you start by outlining the formal relationship between ICOCO and the Scottish ministers? ICOCO is a reserve body that is accountable and reports to the Prime Minister. Scottish ministers have no direct control over ICOCO or its function because it is set out within the regulation of investigatory powers act 2000. Any reports from ICOCO regarding investigations into public bodies go directly to those public bodies, rather than to the Scottish ministers, or they would go to the Prime Minister. There's no direct accountability as such or authority in Scottish ministers over ICOCO and how it functions. How do you feel about that? Do you think that that's satisfactory? I think that there's always room for improvement. I would certainly like to see improvement around this. For example, if there was any Scottish public body being investigated by ICO into a matter, it would be reasonable for Scottish ministers to be notified of that so that we were aware of that taking place. As it stands at the present moment, that doesn't happen. I think that it would be better if there was an automatic notification of Scottish ministers. I also think that it would be useful that, where there is an investigation into a Scottish public body by ICO and they have completed an inspection report of that particular public body, that that too should also be provided to the Scottish ministers, as it stands. The committee will be aware that the UK Government is planning to revise the Regulation for Investigatory Powers Act next year and part of that will also involve changes to the commissioner role. For example, the Office of the Civilian's Commissioner and the IOCOL role come into one and have one single oversight commission. I think that it would be helpful at that particular point if we had a situation where in legislation there was a clear line through the new commission to Scottish ministers to report on any matters relating to devolved bodies that are responsible for functions under this area of reserve legislation. If I can turn perhaps to IOCOL's reports, in the previous section I referred to a February 2015 report from IOCOL. I don't know if you're able to help the committee in advising whether a copy of that was supplied to Scottish ministers or when was your first communication in relation to these matters. We didn't receive an advanced copy of the report. I understand that the report went to the Home Office, but my understanding is that that report is in the public domain now, which is available. That refers to the work that was undertaken by IOCOL in October 2014 and then published in February of this year, which resulted in the code of practice. It was introduced on 25 March. My understanding is that that report is in the public domain now, but it didn't come to Scottish ministers in advance. Can you help the committee by saying when you first became aware of the code of practice and then in turn of a possible breach of it? We were made aware of the intention for a code of practice by Home Office ministers at the end of February of this year and the intention that the code of practice would be introduced in February. It's worth keeping in mind, and I noticed in some of the exchanges earlier on that individuals were referring to changes in legislation. There has been no legislative change. This is a code of practice. The reason it was introduced is a code of practice because there was no time available Westminster in order to introduce it through legislation. My understanding is that the Home Office intends in the changes to the Regulation and Investigative Powers legislation to put the statutory provisions that exist in the existing code of practice into the legislation. It's got a statutory footing for future reference, but we were advised at the end of February that it would be introduced in March of this year. We were made aware of the breaches at the beginning of July of this year. I was then formally given a briefing on this matter by ACC Nicholson in July 15th on this particular matter and the full extent of the issue. Can you tell us about that briefing? It was primarily from part of which you already know that IOCODE undertaken an inspection of Police Scotland between 15th and 17th June. During the course of that, they identified areas where there were breaches in the code of practice that had come in in March. They had relayed that information to Police Scotland and Police Scotland were now undertaking a review as a result of those findings, which would then be submitted to IOCODE. That review was then submitted to IOCODE at the beginning of August of this year. My primary concern was to make sure that Police Scotland were co-operating with IOCODE in any breaches that they had identified. That matter was looked at in detail, which they confirmed was part of the review work that they were undertaking for IOCODE. They would then address the deficiencies that had resulted in those breaches occurring in the first place. They confirmed that, once the review had been completed, they would then be in the process of establishing an action plan in order to address those issues. We also did an interim to contact IOCODE to confirm with them that Police Scotland were co-operating and working with them on the issues that they had identified, which they confirmed. Once the review had been completed, the appropriate action plan would then be taken forward in order to prevent those breaches from occurring in the first place. Do you ask Parliament on a number of occasions to confirm whether or not Police Scotland was one of the forces that has been referred to IOCODE? Do you refuse to provide that information? Could you just clarify for the committee's benefit why you took that view? The context of that is that Police Scotland is no different to any other police force in the UK on the governance and oversight of the use of this legislation for the purposes for which it is intended. That is IOCODE's responsibility in order to undertake that oversight and the accountability role that goes alongside that. They identified in their interim report in mid-July that there were two forces in the UK that they were investigating in relation to possible breaches of the code. That understandably generated interest around whether Police Scotland was one of them or not. IOCODE's view was that, given that that was an on-going investigation and that they were continuing to look into the issue, it would not be appropriate for them to name any of the forces that were involved in those investigations. We accepted and respected IOCODE's position on that. They set out themselves in their own public statement as to why it would not be appropriate to name those individual forces on the basis of the nature of investigation, potential implications that they could have for any further work that they were undertaking and also for the individuals who may have been affected by any breaches. We respected the position that they had set out and the view that we came to was that they should continue to undertake the role and the basis on which they had set out that those two forces should not be identified while they were completing their investigation process. What do you say about the role of HMICS and SPA in this matter? We have to distinguish two different things. My understanding is that HMICS will not be undertaking a review of the investigatory powers area that is the responsibility of IOCODE, who has oversight and responsibility for that area. What the HMICS will be responsible for looking at is the procedures and processes around the counter-corruption unit within Police Scotland. To look at how robust those are, it will be an in-depth thorough and independent review of those processes. The reference for that particular review work is being finalised by HMICS in co-ordination with IOCODE, so it does not go over the area of responsibility and with the SPA before they finalise the heads of agreement on that particular investigation. Is the Scottish Police Authority's role? It will report to it. It is the Scottish Police Authority who have requested this by HMICS and HMICS have agreed to it and it will then report to the Scottish Police Authority. As is always the case with HMICS reports, there will also be a copy laid in Parliament. That was very kind of you to give me my place. I will now let other members in. That should be at the bottom of the list next time. Elaine McAllister, followed by Gil, please. Thank you, convener. For clarification, when did you personally first become aware that Police Scotland might have breached the IOCODE new code? When did that come to your attention? It would have been around 10 July and I was provided with a formal briefing by Police Scotland on 15 July by ACC Nicholson. What action did you take at that point? What I have just set out was to seek their assurance that they were complying with the investigation that was undertaken by IOCODE, which they confirmed they were. They had identified why there had been deficiencies in their process. They were undertaking their review as a result of the findings from IOCODE at that particular point into this issue. That work was then taken forward over the course of July and was submitted to IOCODE at the beginning of August by Police Scotland. That process has already started and has been taken forward. The second thing that I was keen to ensure was that action was taken to prevent this type of thing from occurring again in the future. Part of that was for Police Scotland to take forward an action plan in order to address that. That was progressed following the review work that Police Scotland had submitted to IOCODE on their findings from their inspection. We also contacted IOCODE to make sure that that work was being progressed and they confirmed that that was the case in relation to Police Scotland. They were cooperating with them and the review that Police Scotland was undertaking as a result of the issues that had been identified by IOCODE. Have you had sight of the action plan that Police Scotland has? I have had sight of the action plan, yes. Are you satisfied with it? I am satisfied with it and IOCODE are satisfied with it as well. As I said in their own public statement, it is a robust range of measures that Police Scotland has put in place in order to prevent this type of thing from happening again in the first place. I am satisfied that they have changed the arrangements in order to prevent something like this from happening again in the future. When I posed that question to the Scottish Police Authority about the action that they took, it appeared that the SPA had not taken any action. They sat back and said that it was a matter of faiiolco. As the organisation that the legislation passed by this Parliament scrutinises Police Scotland, were you surprised that the SPA was not more proactive in terms of Police Scotland? Do you have any questions? My understanding is that the SPA was provided with a briefing by Police Scotland on this issue at the beginning of July, so that they were aware of the initial findings from IOCODE's review of Police Scotland's procedures in this area. It is worth keeping in mind that the statutory responsibility for oversight in this area lies with IOCODE. That is based on statute. That is their responsibility. There is an issue about the SPA having oversight in an area that is outwith their control. Equally, Police Scotland has not had a particularly easy year with a number of different issues coming up. Would you not expect the SPA to be a bit more concerned that, yet again, there was bad publicity around Police Scotland? I have no doubt to be concerned, but the point of making is that, in terms of oversight, responsibility for oversight in this area of legislation is with IOCODE. It is the exact same for Police Scotland as it is for any other police force or any other public body in Scotland. What happens in Police Scotland is no different to what happens in any other police force in the UK with IOCODE having responsibility for this area. It is important that lessons can be learned from that. The actions by the SPA to request the HMICS to undertake a review of some of the procedures and practices within the counter-corruption unit is useful. I would fully expect if there are any findings from the HMICS review in this area for the SPA to pursue those matters with Police Scotland to ensure that they are appropriately and fully implemented. IOCODE said that the actions of Police Scotland had been reckless. What you understand by the definition of the term reckless is used in legislation. It is in the abusive behaviour and sexual harm bill that we are having to postpone. What do you understand is the definition of the term reckless? In terms of definition, you would have to put that to IOCODE, who has made the determination on that basis. There are essentially two levels that IOCODE can make a determination to say whether it is willful or reckless. In this case, having considered the matter, they have decided that the issue was reckless. The distinction being that there was no deliberate act in the part of officers within Police Scotland to willfully not apply the code in itself. However, they have been reckless in failing to actually apply it in the way in which it was intended, which could have had an impact on individuals who were affected by that. However, the final definition around the determination is a matter that you would have to pursue with IOCODE, given that it is their responsibility to come to these determinations. DCC Richardson seemed to imply that the definition was in some way confidential. Does that surprise you? That would be for IOCODE to explain that to you if they do not intend to explain how they have come to that particular definition. My understanding is that the marked difference between being willful and reckless is that there was no deliberate attempt. In fairness, IOCODE has stated that as well. Police Scotland has made that clear in its own statement following the investigation that there was no deliberate attempt for them not to apply the code. Clearly, an error has been made by an officer who I have no doubt was trying to do his best in relation to the matter, but the code has not been properly applied in this instance. There is an understanding in Scots law what reckless means, because we use it in legislation. Is that a difference? Is it reckless and IOCODE's definition of reckless is not as rigorous as our definition of reckless? I do not really want to agree to IOCODE's explanation of their definition. You would have to pursue that specifically with IOCODE, given that it is their definition and their determination. Gil, please, followed by Margaret Mitchell. Good morning, minister. We heard that some of this came about because there was a push for the timeline to come in early. I wondered what comments you would like to make to that. Was the Scottish Government involved in this push to take place quicker? The timeline relates into the work that was commissioned by IOCODE around the way in which the police were obtaining communication data relating to journalistic sources, which started in October 2014. I believe that it was to the Home Office in February of this year. The timetable for its introduction was a matter for the Home Office. There were concerns expressed around the speed at which it had been introduced. I believe that the commissioner himself, Sir Anthony May, raised some concerns about that. I also recognise that there was a desire to make sure that the issue was addressed. I suspect that, largely prior to the dissolution of the Westminster Parliament, arrangements were in place for any requests that were made by the police for this type of communication data. I suspect that that was probably one of the biggest factors that had an influence on the issue. Having said that, that might have led to some of the challenges that have been presented. However, notwithstanding that, I also have identified where there have been deficiencies. It is important that they are appropriately addressed. Action is taken to prevent it from happening again in the future. Since you pointed out to yourself, minister, that this is a code of practice rather than a statutory practice, the fact that it was a code of practice could have been the case that a decision could have been taken here in Scotland to slow the process up, recognising or, again, as it is in hindsight, because we know what has happened now and because of the shortage of time. We could not have delayed it because it is a reserved area. The code of practice was taken for by the Home Office. It was not an area where we were in a position where we could have decided to take a different approach in Scotland. That applied to all forces across the UK and the timeframe that was set by the Home Office. It was for all forces across the UK that were covered by the legislation, but we were not in a position where we could say that that would not apply in Scotland because it was an area that was outwith their competence. Finally, have I also been invested in getting any other Scottish public bodies this year or in previous years? If so, how many? You might be aware of it. I know your limitations because it is reserved. I am not aware of them. They undertake their annual review process of public bodies that have powers under the Regulation for Investigative Powers Act, but I am not aware of them having findings against any other public body in these areas. I would expect, from any inspection process, areas where bodies can always make improvements, but they have not flagged up to Scottish ministers any concerns about any specific public body about how they are applying Regulation for Investigative Powers legislation or its guidance. Having said that, I go back to my earlier comment, they would not notify us of those matters anyway because they are matters that are reserved and they would not direct any information to Scottish ministers in these instances in the first place. Even though they are reserved ministers, do you think that it would just be common courtesy to inform the Scottish ministers in that regard, even if it was not to take any action but just to keep you posted? Or does that take place? Do they keep you posted in the software record door in a way that you are not able to act on it? The cabinet secretary admits that it is on the record door. Well, neither on the record or off the record. That was very informal. That has been the position for successive Governments in the Scottish Parliament, because the legislation has been in place since 2000. I was actually on the Justice Committee when we dealt with the Regulation for Investigative Powers Scotland Act. You were there together, cabinet secretary, how far you have come and how far I have fallen. As I mentioned earlier, I think that revising the legislation and looking at changes that can be made to it, one of the areas that I wish to pursue is the issue of making sure that the Scottish ministers are notified of any concerns that I also have or that successor organisations have around any specific Scottish public bodies that have powers in this area of revs legislation. I think that that is a reasonable thing to expect and also it provides ministers, and to some degree, Parliament, with an assurance that there is a feedback into Scottish ministers around any areas of concern that have been raised by a commissioner in relation to how a public body in Scotland may be operating in these areas. I could just take people in order, Alison, because everybody is pretty well in the same thing. Margaret Mitchell followed by Christian, Alison and Margaret MacDougall. Good morning, cabinet secretary. You have stated on a number of occasions, again today, that the statutory oversight for the code of practice was reserved and it was Iowaka's duty. We now have the findings from the investigation. Are there any areas of the findings that the Scottish Government has to gwald competence over looking at? In what way? I'm not entirely clear about what the point is. I know that there has been a breach of article 10, which is the freedom of the press article, and the implementation of the convention is a devolved issue. What is the Scottish Government's reaction to that? If I understand your point correctly, there are no recommendations for the Scottish Government in the Iowaka report. Secondly, there is an area of reserved legislation. The code of practice is a matter that is reserved, and the oversight of it is reserved as well. The action plan that has been developed has been developed by Police Scotland following their own review of the matter, given the initial findings from Iowaka. Iowaka then conducted their further detailed investigation following the review that was received from Police Scotland in August of this year. During that period of time, Police Scotland developed its action plan to address the issues that had been highlighted and shared with Iowaka to seek its assurance that the changes that they were making would address the concerns and issues that Iowaka had. To prevent a breach like that from happening again in the future, Iowaka has now stated that it has put robust measures in place in order to prevent that from happening again in the future. We have assurance from Iowaka and from what I saw from the action plan that Police Scotland has taken forward a range of different measures to prevent something like that from happening again in the future. Even though the Scottish Government has responsibility for the implementation of the convention and there has been a breach of one of the articles, article 10, the Government has no responsibility or does nothing else to follow up on that, given that it has devolved competence for the implementation of the convention. I am not entirely sure of the logic of that, but the issue around article 8 and article 10 are issues that relate to some aspects around that. However, the oversight and the legislation that it relates to are reserved areas and the action that has been taken has been agreed that it is the appropriate measures in order to prevent this from happening. I am not entirely sure what else we would expect the Scottish Government to do. I suppose that we should look around the whole implementation of article 10 and see if there is anything within the organisation. The committee is very frustrated that the SPA has never seemed to be hands-on and we always have another assurance review and never seem to have too much teeth. If there is an implementation of the human rights aspect, I am merely checking that the Scottish Government is quite confident in its own mind and in your mind that you have done everything possible to make sure that there are no breaches of articles that we have devolved confidence in a wider view of what is going on in Scotland. Now that the issue has been highlighted, it is a very serious issue and I am sure that you will appreciate that freedom of speech in any democratic society is fundamental. I am mindful that some people would like to abolish the human rights act and move it from their statute. Perhaps you would like it to be implemented better than it is being implemented. That is a different debate then, not the one that I am familiar with, but from the Conservative Government Westminster. What I can say is that issues around ECHR were considered by IOCO during the course of their investigation and they have said that robust measures have now been put in place to prevent this from happening again in the future. I am confident that given IOCO's expertise in this area and knowledge in this area that those robust measures are now in place and having considered the action plan as well, I am confident that they have put the right measures in place as well. The member will also be aware that one of the outcomes from an investigation like this is that there is the possibility of an investigative power tribunal, which can consider these issues further and can consider the extent of the impact that is had on individuals who were affected by this. I am aware from the media that there is already one party that has indicated that they would intend to take it to a tribunal. They are in a position to look at this in more detail on how it is affected by that individual and to look at whether there are any further measures that need to be taken as a result. That is a process that is still to be gone through by those individuals who believe that their rights have been infringed and they have been notified of that by IOCO and IOCO have a responsibility in making sure that they are furnished with sufficient information for the purposes of taking forward any case due to the investigative power tribunal, which again is a reserved area, which is part of the statutory provisions in this area of legislation. I think that you have answered my question, cabinet secretary. Christian, followed by Alison, please. Good afternoon, cabinet secretary. Just a point of detail, just to clarify, I may be misunderstood, but were you made aware of the change of the code of practice? We were made aware of the intention to introduce the code of practice towards the end of February this year. I had a discussion with the Home Office Minister, James Brokenshire, who was responsible for taking forward this area within the Home Office. Do you discuss the implication that a quick implementation will maybe be a problem? Did you forecast in your discussion of any problem that could arise because it was not enshrined in the legislation but it was only a change of code of practice? Part of the challenge that the issue was referring to earlier on was that there was no time at Westminster for them to put this on a statutory footing. They were also mindful that they were intending to look at, in post-elections in the new Parliament, changes to the investigative powers legislation, which the committee will be familiar with. The UK Government has already set out the plan to take forward. The most practical way in which to deal with it at this time would be through a code of practice. Clearly, there was pressure on Westminster's timetable because of the pending general election that was coming forward. There would be challenges in its implementation. That was a challenge that the Home Office was aware of, but it was also highlighted by the commissioner himself. However, the decision was to make the code of practice available and to put it in place prior to the dissolution of the Westminster Parliament. Cabinet Secretary, you would agree that the urgency, if I recall, at Westminster at that time was precisely to protect journalists following attacks on press freedom. There was an urgent need to do something. We were opposed to that. We welcomed the code of practice. We believed that it should be put on a statutory footing rather than as a code of practice. That is a helpful clarification. This morning, DCC Richardson sought to excuse the breaches of the code of practice by saying that the pace was aggressive and pressured in introducing the guidelines. Do you agree with me that, if the DCC was so concerned about that, it would have been reasonable to expect him to have sought to make representations about that, or to ask you to make representations to Westminster about that? It is fair to say that it was a very tight timeframe to introduce the code of practice. There have been some challenges. Part of that, the most recent findings from my local, may be in part as a result of some of that timetable. However, I am also conscious that forces across the UK all had to apply the same rigour to that particular issue. I think that there were some challenges around guidance being provided to the police through the Home Office and also through IOCO. For example, in one area in the timeline, I am looking at this, which may be of interest to the committee in pursuing these issues with IOCO as well, is that the IOCO published its guidance on the independence of the designated person at the beginning of June. Even with the code of practice coming into force as of 15 March, there was still a gap in the provision of some of the guidance that was then passed on to the police and to other public bodies and other organisations who have pillars in this area. It may have contributed to some of the challenges in those areas and I think that it is reasonable for Neil Richardson to highlight some of the challenges that I did create for him at that particular point. Police Scotland, on a number of occasions, has had less regard than I would like them to have to human rights compliance. I think about what we have had to do in relation to stop and search and we have got this. Are you comfortable and satisfied that Police Scotland has the necessary expertise within the organisation to fully comply with ACHR or do you feel that we need to review what is available to them? Do you mean in terms of legal expertise within the organisation in understanding ACHR? Have they been properly advised and then able to roll that out through the organisation so that it permeates everything that they do, to be honest? Police Scotland has to be compliant with ACHR in the same way that any other public body in Scotland has to be. In this particular instance, a mistake has clearly been made by, as you have heard from Neil Richardson this morning, a very experienced officer with a considerable level of expertise in this area. A mistake has been made and I need to ensure that lessons are learned from that and to prevent it from occurring again in the future. I am very conscious that, as part of police training and part of their on-going work, they are regularly refreshed and advised about human rights issues and implications of those issues. To make sure that the approaches that they are taking are compliant with those areas in legislation, I have been at briefings within Police Scotland where officers are going out on particular operations where that has been reiterated to them. I think that there is a strong recognition within Police Scotland that they need to be compliant with ACHR and that they should not be acting in a way that compromises that. In this particular case, there have been deficiencies that have resulted in the wrong judgment being made. I would go back to the point from ICO in that it was not a deliberate act in order to misuse the legislation or to deliberately ignore the codes of practice. I want to ask the question about judicial approval. It is in the code of practice where police request communications of a journalist source. Is that a new requirement? For the judicial approval? Yes, it is. Prior to the code of practice coming into force, there was no judicial oversight of it. The code of practice introduced a judicial oversight. There are two key areas that the new code of practice introduced. One was the provision of the designated person in authorising a request for this type of communication data. The second part was judicial oversight on that about journalistic sources. The code of practice introduced new provisions in order to provide stronger safeguards in this area. The report that ICO had started in October 2014 was specifically looking at how the police were using those measures when it came to journalistic sources. The two key parts of the code of practice are the designated person and the judicial oversight. The code of practice came out in March. March 25 came into force. You would expect an officer with the expertise that we have heard that Detective Superintendent Davidson had. Donaldson, the two points that you have just pointed out, he would have picked up on that, the main differences are. He would have been able to identify that he needed judicial approval to look into that. As you have heard from Neil Richardson this morning, the explanation is to how that has not come about. The officer who was dealing with it has taken a very narrow view of the request, rather than considering some of the wider issues, which resulted in them coming to a judgment, which meant that the code of practice has not been applied in the way in which it should have. The oversight function through ICO, through the air inspection of Police Scotland, has identified a deficiency. I asked him to review that matter and for the men to put appropriate measures in place to prevent it from occurring again in the future. Neil Richardson is better placed than I am, from an operational point of view, to explain the process that the police use in taking these matters forward. Clearly, an error has been made and in those cases judicial oversight of the decision should have taken place. The action plan, which was a result of the review, had 12 points on it. All of the 11 action points have been executed, as far as I know, except for the one on judicial reviews and approval. Is that not of concern to yourself, given that that was the issue? My understanding is that Police Scotland is already in the process of putting in place the right judicial process for that. That is what you told us this morning. Yes, it is in the process of putting in place the formal process to ensure that that happens, that that mechanism is available to them for any future decisions in these areas. It is not a case that they are not doing it, it is in the process of resolving that area and identifying it in their action plan. It is not implemented if it is not resolved. Are they working to implement it just now? I think that this is the point of information market. The updated code of practice now requires the police to seek judicial approval in such circumstances. In the action plan that we spoke about earlier, one of the points was that, around the judicial approval—I forget the title, Mr Richardson, who was here this morning—he said that they had all been implemented apart from the one around judicial implementation. During the process of taking forward that particular action point within their plan, it is clearly in Police Scotland's interest to make sure that that is addressed. If they do not have that, there will not be a position where, if they deem it necessary to obtain communication data and it relates to the provisions within the code of practice, they will have to have the judicial authorisation process. Is that discretionary or mandatory? If those other tests apply? Of course. They will have no choice. You have not exercised it yet. It is not complete as far as their action plan is. That is the point that I am making. We do not have that as yet. Will you leave it at that just now, John? Cabinet Secretary, you have laid out a very clear timeline of the Scottish Government's engagement on that particular issue. I am grateful for that. We heard a less-than-clear position put forward by Mr Richardson. Maybe that clarity will come with all the various follow-up notes that he is going to give us. You have commented frequently about statutory oversight, and we all understand that there is a role for that. Once again, the police authority looked like bystanders. They looked like onlookers to a process always playing catch-up. We are told that, in August of this year, they received a briefing from Police Scotland, and three or four months later the institute an assurance yet another. I hope that Mr Penman is getting additional resources for all the additional work that he is doing, because he is a perennial... I am sure that you will have him in mind. There is a very serious issue here. I wonder what role you see for the police authority. They are effectively making themselves redundant when they do become involved. It is playing catch-up. It is calling on the good services of Mr Penman and his staff, and I think that we should all be grateful for the diligent work that they have done in relation to stop-and-search and armed policing and arrest. Are they doing themselves a job? No, I do not agree with that. Are there areas for improvement? Of course there are. Are there ways in which the Scottish Police Authority can ensure that they are undertaking robust and challenging oversight of the way in which Police Scotland is operating to identify areas where they believe that improvements could be made? The SPA does a range of that, but there is always room for improvement. I do not think that the SPA would say that there is not room for improvement as well. I do not want to... I think that it is worth reiterating the point that oversight in this area lies in a statutory basis with IOCOL in the same way that it does for every other police force in the UK. I think that there is room for improvement around how IOCOL engages with some of the oversight bodies that may have a role around policing in general and how they share information with them. Notwithstanding your own view on the matter about the need for the SPA to try to get ahead of the curve, which is where I presume your central point is, it is worth keeping in mind that the statutory oversight in this area is the responsibility of IOCOL in the same way that it is for every other police force in the UK. I appreciate that it is a reserved matter. I know that you are not suggesting total disengagement, but we also have other groups who have the information commissioner, surveillance commissioner and perhaps most importantly, more locally, PURC. It must be that there is a bit of proactivity that is required of the police authority. The committee can do it, the sub-committee and policing can do it. They have been behind the curve on every major issue. As I have already mentioned, there are areas for improvement. We have a new chair in place who has undertaken the governance review at this present moment, which will report in the spring of next year to look at how we can improve governance more effectively around certain policing matters. I am keen to ensure that we make progress in that area as well. Over the past two or almost three years, it is now a good time for us to look at how we can improve the governance process and oversight process, and that work has already been undertaken. It is also important that we do not lose sight of who has the statutory oversight in this particular area, given that that is what we are considering here today and the way in which that operates. Given the type of architecture that we now have in Scotland around policing and the oversight of policing in the way in which it operates, the changes that are made to the commissioners role around the regulation investigatory pills gives us an opportunity for that better to reflect that changing relationship and the different type of architecture that we have in place for oversight of policing in Scotland. Much of the cabinet secretary takes place against the backcloth of the Emma Collwell murder and accelerating the case again. It was interesting that the Procurator Fiscal wrote to Police Scotland on 25 May 2015 to tell them to accelerate matters. I have not seen the letter. I respect the independence of government from the prosecution service. Do you know anything about that letter? You need to pursue that matter with the Crown Office directly. While we are talking about the process here, what is really all about at the end of the day? The questions arise about Police Scotland reading things in the paper. Who is leaking this? They do stuff. We must accept that the IOCCC was not willful but reckless, but it is not happening in a vacuum. In the middle of all that, the investigation into this historic murder case takes a step up. That is what I am wondering about where that all comes into, but you are not in any part aware of any of that. It is a live investigation. It would not be appropriate for ministers to start commenting on a live investigation, but you would have to, in order to explore further the Crown Office's views on those matters, you would have to pursue that. That is fine. Thank you very much. Thank you for your evidence to have no other questions. I will suspend for a couple of minutes. To instrument the litigants in person costing expenses, sheriff appeal court order 2015, SSI 2015 oblique 398. This order would allow a party litigant to recover certain sums in relation to civil proceedings in the sheriff appeal court where an order of expenses had been made in their favour. The DPLR committee did not draw any concerns on the instrument to our attention. Have you any comments? Are members content to make no recommendation? When I move on to item 1, that has been moved into private session.