Digital evidence at the police station: downloads, passwords, and disclosure basics
Phones are now involved in most investigations, whether as evidence of communications, location, images or contacts. Questions about devices come up at the station all the time: "Will they give my phone back?", "Do I have to give them my PIN?", "What have they got from it?" This is a primer for reps. It isn't advice for a specific case.
Seizure
Devices are usually seized:
- on arrest or search (PACE ss.19 and 32), or after a search of premises (s.18, or a warrant)
- under the "seize and sift" powers in the Criminal Justice and Police Act 2001 (ss.50–51), where the device can't practicably be examined on the spot
The client should get a record of what was seized (PACE s.21). Getting devices back is covered in Seized property.
Voluntary extraction
The Police, Crime, Sentencing and Courts Act 2022 (Part 2, Chapter 3, from s.37) allows police to extract information from a device that a user has voluntarily provided and agreed to the extraction from. It's mainly used for victims and witnesses. There are extra rules for children and adults without capacity (s.38) and on what voluntary agreement means (s.39). A suspect's device is normally seized under the powers above rather than under s.37.
PINs and passwords
Being asked in interview
A request for a PIN in interview is a question like any other. The client can decline to answer. Weigh the risk of an inference, and what's likely to be on the device.
Section 49 RIPA notices
Under the Regulation of Investigatory Powers Act 2000, Part III, the police can, with the proper authority, serve a s.49 notice requiring a person to disclose a key or password, or to put the protected information into an intelligible form. Failing to comply is an offence under s.53. The maximum is two years' imprisonment, or five years in a national security or child indecency case.
A request in interview is not a s.49 notice. If a notice is served, the client needs specific advice: the notice's requirements, the time to comply, the defences in s.53 (for example, that they don't have the key), and how compliance or non-compliance fits with the wider case.
What the police may have
Ask about:
- Whether the client's device has been downloaded, and what type of extraction was done
- Whether other devices (the complainant's, a co-suspect's) have been examined
- Messages, call data, location data, or social media material the police intend to rely on
- Any cell site or ANPR analysis
Often the honest answer is "not yet". Downloads can take months. Factor that into your advice: a client giving a detailed account before the police have analysed the data risks inconsistency.
Disclosure issues
The material on a phone is often voluminous. Under the CPIA 1996 and the Attorney General's Guidelines on Disclosure, investigators must pursue reasonable lines of enquiry, including those pointing away from the suspect. If the client says messages on their phone, or the complainant's, support their account, ask that this be noted as a line of enquiry and record that you asked.
At the station
- Note what devices were seized, and when.
- Advise the client not to delete anything, from any device or account. Deleting material can be an offence or lead to adverse comment.
- If a s.49 notice is mentioned, stop and get specific advice before the client responds.
Sources
- Regulation of Investigatory Powers Act 2000, ss.49–53 (legislation.gov.uk)
- Police, Crime, Sentencing and Courts Act 2022, ss.37–44 (legislation.gov.uk)
- Attorney General's Guidelines on Disclosure (GOV.UK)
General information only. Not legal advice for any specific case.