Gweldodd amser a ch sucksb yn nid o ar y dyfodol y辮oddiadau gwybodaeth yn 2016. Rwyf rhythms yn ymfynnidig, requested that the members of the committee do not interfere with broadcasting, even though they are switched to silent, so if they could switch them off completely, that would be appreciated. Any members using electronic devices to access committee papers during the meeting should ensure that they are switched to silent as yn achos chi'n mynd i arddangos. We've got apologies from Liam McArthur. Agenda item number one is declaration of interests. I'd invite Mary Fee to declare any relevant interests. Mary Fee is the new member who has signed the register of interests. I also, for the record, state that, in session four, I convened the cross-party group in families affected by imprisonment ddatblygu ar nôl eiwaith i gyn translygio'r ringhwyl ar unrhyw. Thank diwethaf. Daiwg wedi hyn swyddifory imeb. Ones. It's my pleasure to welcome Derek Penman, HMI Inspector of Constabulary, Stephen Whitelock, lead inspector, John Young, associate inspector, HMICS. I say at the outset that we're very grateful to the inspector of constabulary for responding to the committee's concerns about the slippages in the reporting timetable and producing Rydym ddim yn fawr o hyn o gwaith eich gweithio? Rydw i ddim yn fawr i gael i gweld ar gyfer hynny och gyfer y obstuedd. Môn pan fydd yn rwyf iawn mewn llawer o han哦fynu gmoren. The First Minister is a great briefly. I thank the committee for the opportunity to speak on our report to Count a Corruption today. As you are aware, the report was requested by the Scottish Police Authority, which identifies its interests with the report. Felly weith CAS M$B has been published a commitment from the chair and the chief constable, to accept our recommendations and to take them forward. Just by way of some background, if I may, HMIC and other role is one that is independent. My role is to look at the effectiveness and efficiency of policing in Scotland and my focus is very much on adding value. My task is to identify improvement in policing and not to portion blame, identifying blame mwy eich cyhoeddod is to information that is protected where people have provided information in a confidential basis. There is an understanding that that information would be kept confidential and for that purpose is for myself not to breach any trust or confidence in that or identify any sources or indeed any covert techniques or tools that have been applied in that. My starting point on countercorruption is very much that Police Scotland needed to have an effective counter-corruption capability, but that capability must have the same ethical standards and conduct itself in the same manner in which the rest of pre-scoldland conducts itself and it has to be subject to effective scrutiny. I'm aware of the committee's interest in this and in particular we took the opportunity in our review to look at, as a case study, pre-scoldland's wider investigation into the circumstances surrounding the lies leak of information. Mae'r llawer i'r cyfnodd gyda gyda'r ynfocuse o'r cyfrgylcheddau wirwgol am y Murder Ema Caldwell. Mae'r clywed yn cyfrgylchedd hwn dw i'r cyfrgylchedd hwn, a'r cyfrgylchedd hwn wedi'r cyfrgylchedd ar hyn o mhyddgau mlynedd ym Cymru. Rwy'n credu i'r clywed a'r cyfrgylchedd hwn o'r cyfrgylchedd hwnnw, a ddim umser o'r clywed ddim umser ar hwn o'r cyfrgylchedd hwnnw ddiweddol ar envyll ar ddod. Areolaethau цis arno iawn i eich ffawr yn ddegwydd yrwyr diwylliant yr EMA. Rwy'n constantson ei яchwr i gael'r diwylliant. Raen lle hynny'n ddigidio'r diwylliant, ond mae'n rhagorio'r cyddoedd, a gweinio'r diwylliant ar hyn sy'n cyhoeddwr. Mae'n ddigidio'r diwylliant.  Mae'n ddiddordeb ar ddigon o thysg, mae'n gweithio i'r ffordd ddod ar gyfer cyfraedd i'r cyfan, ac mae'n fawr i'r ffordd i'r ffordd i'ch ddigon i'r byw i'r cyffredinol. Felly, ddysgu'r Llywodraethau a Llywodraethau yn eu ddweud i'w ddwybrligt's efforts into finding the source of a leak to the detriment of Emma Caldwell." That was some of the media speculation that existed at the time. Our review has shown that Police Scotland acted quickly and undertook a review and have a robust investigation in place. It is also important to note to recognise that it is currently alive for the investigation and it is not helpful to speculate on suspects in a way that may compromise that prosecution. IOCA's determination, in part 1, we did not review or we have not commented on the findings of the commissioner specifically around his dealings with those applications. IOCA published a memo and submitted supporting documents on 17 June. We consider them to be particularly helpful in that for the first time they place a full account and the extent of criticism from the commissioner into the public domain. Therefore, we have not found it necessary in our report to provide that level of detail and to rely fully on the IOCA determination. We are also aware that Police Scotland has conceded that the communications data authorisations were obtained in contravention of the 2015 code. Those affected by that have the real remedy through the investigatory powers tribunal hearing in July. Again, it is important that our report does not compromise the integrity of those proceedings. I can't, I'm conscious of time, if I just perhaps just take a few more minutes if that's okay to you. Very briefly, Mr Fen, we have a number of questions where I'm sure you'll get the opportunity to elaborate on anything that you're going to cover very briefly in your opening statement. Thank you. It's just really some key points around that. It was really to say that from our review, Police Scotland was aware on 21 August that the information that was suspected to have been leaked to journalists had in fact been released some years previously to Crown Office. They were also aware that there was no live inquiry at the time of the Sunday Mail article and our report highlights that that might have been useful to have clarified that evidence at the time that they gave evidence to this committee. We also found that Police Scotland was prepared for the code and organisation hadn't failed in promulgating that information and that the designated person in this case had actually asked for and advice was given. We found no evidence of any undue pressure of coercion on the designated person or anyone else to undermine the code or any chief officer involvement. Our final conclusion was that all lines of inquiry were not fully exhausted by the CCU intelligence section. We believe that the review lacked objectivity and applied for data communications too early in the process. I note that we did expect you to make a two-minute opening statement. You've now given almost a five-minute statement. Just for the record, in future, when we get opening statements to any witnesses coming, we'll expect them to keep to the very brief timescale. I'll now take questions. I'm inclined not to start with Stuart Stevenson because he indicated when Mr Perlman was speaking, when he really should have been listening. This time I'll let you off Mr Stevenson, but... That is entirely out of order because it's specifically on the statement that was made that I wanted to indicate a desire and it's not. Right. Well, I misunderstood that. Is there anything else that you want to see now, then, Mr Stevenson? If you allow me to answer the question, which is very brief and requires only a very brief answer, if I may suggest. It's about the general role of the inspector. You said that effectiveness and efficiency are the key things that you're looking at. You then drew that you wanted the same ethical standards as applied in the rest of the presports to apply to the CCU. Understand all that. I just really wanted to ask whether the examination of ethical standards is something that you normally incorporate in all the investigations and work that you do across the presports, and it's as simple as that. Yes, that would be the short answer in as much that we do look through our inquiries to see if the values in particular of Police Scotland around integrity, fairness and respect are evidenced by the leadership as we go through our reviews. Thank you. Thank you. John Finnie. Good morning, Mr Perlman. I thank you for your report and your on-going detailed work. Mr Penman, the committee heard from the Deputy Chief Constable Neil Richardson on 15 December. Mr Richardson lied to the committee. Is that correct? I'm not saying he lied to the committee. I think in my report what I said is the evidence that he gave in relation to whether it was a live inquiry was the initial assessment that had been provided to him by the CCU, and that was the evidence that he had provided and that was accurate at that time. The observation that I've made in my report was at the time that the evidence was given that Police Scotland would have been in a position to have known that it wasn't a live inquiry and that the information that had been reported in the Sunday Mail had actually been provided by Crown to others some years before that. So, the committee was given erroneous information by Mr Richardson? My view would be that it would be an opportunity for Police Scotland to have given a better account of that evidence that would have been helpful, I think, in terms of the public's understanding of it and provided an explanation for the people who read the Sunday Mail about where the source of the information might have come from. The remit of the counter-corruption unit with the internal focus talks about reducing the risk of compromised on-going operational activity, and clearly that answer related to what should have been on-going operational activity to reduce the risk per cent of individual officers or members of TAF to increase public confidence. Would you imagine that what we heard from Mr Richardson would have triggered an inquiry by the counter-corruption unit? As we have highlighted in the report, taking the circumstances as they were assessed by the CCU, if there was a live murder inquiry and the information from that live murder inquiry that was sensitive and may have the opportunity to compromise the integrity of an on-going prosecution had been leaked, it would be appropriate for the counter-corruption unit under those circumstances to have an investigation into that. For the void inside out, Mr Penham, I am specifically saying the conduct of Mr Richardson, either in what will be generous in saying not knowing or in lying to this committee. It is a convention in the chamber that we do not use that word. Inaccurate with his account would be preferred. It is a very strong word in the chamber that we tend to avoid. If we can avoid it here, I would appreciate that. Okay, an inaccurate statement, knowingly an accurate statement provided. Is that something that the public would rightly expect would trigger some form of inquiry? If so, who would initiate that inquiry given that the person who has uttered that inaccurate statement knowingly is indeed the disciplinary authority for Police Scotland? I suppose that my taking a specific example of that, our report was quite careful in what we said, and that was at the briefing that Mr Richardson gave to the committee, reflected the initial assessment of the CCU at that time. I suppose that what we have said is evidence could be clearer. To answer your general question where a senior officer would provide evidence to this committee that was seen to be inaccurate, there should be opportunities to address that behaviour either through the committee but ultimately through the Scottish Police Authority who have responsibility for the discipline of senior officers. Do you understand that your report will trigger any inquiry against any senior officers at all? I am not aware of our report, specifically triggering any inquiry in relation to a senior officer misconduct. I wonder who had sight of the report in advance of its publication, Mr Penman. In sight of our report, we provided copies of our report to IOCAR, to the Investigative Powers Tribunal, to the Scottish Police Authority, to Police Scotland and to the Scottish Government. Who at Police Scotland was the recipient of that report and who had access to that report? The report was predominantly provided through the Chief Constable, but it went to the Deputy Chief Constable, Eamline Winston. Beyond that? I understand that the circulation of the report was kept very tightly, and it was for the purposes of factual accuracy checking. It was involved in the Deputy Chief Constable, Ruth Nicholson, and a member of the CCU. Would Mr Richardson have seen the report? No, Mr Richardson would not have seen the report. I understand that. Do you have control of exactly who sees the report? We circulate the report to Police Scotland for factual accuracy checking by matter for Police Scotland to determine who it was that would have access to that report thereafter. In our dealings with Police Scotland, it was predominantly through Mr Livingston, Mr Nicholson and a member of the CCU in terms of its technical detail. You would not be able to see definitively who had prior sight of the report? No, Police Scotland could have shared it with other people in the organisation. A couple of other questions about the professional standards department in the counter-corruption unit. The relationship between the two departments, Mr Penman, is a former Deputy Chief Constable and Senior Officer. Do you believe that there is sufficient separation? Can you be reassured that investigations are fair and impartial? I do not, as a short answer. We made a comment in a report that there needs to be functional separation between the counter-corruption unit and professional standards. We found that the counter-corruption unit was in fact doing work that we would have expected to have been done by professional standards. That has a knock-on effect to those who are subject to those inquiries, where they are seen by their colleagues to be interviewed by counter-corruption, and I think that that provides them with some reputational issues. We have been querying our report that there needs to be a better separation between the two. Did you encounter what might be referred to as a lad culture in those organisations? A lad culture? A lad culture? No, not at all. Perhaps I am not sure what you mean by a lad culture. A very boorish gender-specific male dominated atmosphere? No, there was no gender-specific behaviours that came across from that. What report did I lead to, and we did have the opportunity to speak to a number of officers who have been subject to counter-corruption inquiries, and the report is quite clear that they raised some concerns around the manner in which they had been treated from that. There is certainly nothing put forward in terms of gender. Finally, what is the relationship between your report and any criminal or misconduct inquiries that your report might have highlighted? Do you believe that it did highlight criminal or misconduct? In terms of our report, I do not think that our report is in order to be seek to identify any misconduct from there. It will be a matter for others to assess our report and consider what is contained within that and whether there are any misconduct proceedings to come from that. No, I do understand and noted your opening statement, Mr Penman. Given your experience as a former deputy chief constable in disciplinary authority, is it your view that what was exposed was criminal or disciplinary? No, there is nothing in our report that we would say that we identified that it would be criminal behaviour from that, but again in terms of our misconduct and methodology. Again, I think that it would be for others to decide whether there is misconduct that would arise from anything within the report. As you will see, there are some recommendations where we asked Police Scotland to specifically look into investigating some circumstances. Once they are investigated, that will be something that may or may not be considered by them. You do not feel that, given your professional background, you are able to comment on whether misconduct has been exposed as a result of that? I think that, given my role as an inspectorate, it is for me to identify where we can find improvement and that is what the report has done. Okay, thank you. The First Minister is concentrating on those recommendations. I have Ronan and Douglas Stewart. Was it a supplementary? John Finnie is questioning to you to use the phrase, I think, twice, certainly once, knowingly inaccurate. I took from your answer that the inaccurate part was accepted, but the knowingly part was rejected. Is that correct? I think that it seems to be very difficult for me to say what I know is the evidence that was given, that evidence reflected the initial briefing from there, so I asked whether it was knowing that I am not in a position to comment. However, just to be absolutely clear, you have no knowledge that, in saying that it was a live inquiry, that was a knowing misrepresentation of what he knew. In other words, he was not deliberately misrepresenting. No, it may be helpful for members to understand as well that the assessment by the CCU at the time in April was that it was a live investigation. Some of that came from, just by background, that the person who came forward with the initial referral to the counter-corruption unit was the superintendent in charge of the homicide governance review. His job was to look after all of, effectively, the cold cases that existed in Police Scotland, one of which would have been Emma Caldwell. I think that an assumption may have been made because of the person who was coming forward to make the referral, that that was, in fact, a live inquiry. The reality was that an individual had been previously involved in Emma Caldwell, and that was the reason for the referral. There was a reason why Police Scotland may have believed that it was a live inquiry. Having said that, as I said in the report, I think that Police Scotland should have quickly bottomed out the fact that it was not a live inquiry. That is fine, thank you. Again, a supplementary very briefly. I will allow a little bit of supplementary if we are pursuing a line. Just on two points from John Finnie. First of all, on the distribution of the report, can I ask why on the 20th of June you wrote to this committee saying that it would be an interim report, but then we are able four days later to say that it would be a full report? We welcome the fact that it is a full report, but I thought that four days is a very short timescale for you to change from it being an interim report to a full report. I can indeed cover that. As you will be aware, I also wrote to the committee previously to say the timescales that had originally envisaged were going to be pushed out, and it was our hope to publish the whole report the week commencing the 27th, which was yesterday, and that was still our timeline. It was the request from the committee that we tried to bring that forward. We brought it to the Monday that was going to cause us difficulties around timing, so the large part of our report was done, but the issues that we had were around factual accuracy and getting the report published in time. I wanted to commit to the committee to have something, and what we could have committed to was part 1 of the report. It was no more than the fact that we felt it was helpful to have the whole report done and that we have accelerated our work to get that done in time. Can I ask for new members of the committee who have just joined? We weren't here when the Deputy Chief Constable gave his evidence on 15 December, but since then, what action did Police Scotland take to rectify that erroneous statement? I'm not sure of what statement was made publicly in relation to remedy it. We were clear of the evidence that was given to Parliament having done the review and know what we knew. We felt that it would have been better if that had been carified. During your investigation, was there any evidence that anyone at Police Scotland, after hearing the evidence given by the Deputy Chief Constable—I presume that they review what is said and the questions that were made at the committee—did no-one at Police Scotland say to the Deputy Chief Constable and then come back to the previous Justice Committee that there may have been information given that was misleading? Not that I'm aware of, but again it comes down to the interpretation of the evidence that was given on the day and whether the evidence that was given on the day was in fact factual accurate. Our report reflects the fact that it would have perhaps been better to have had more clarity around it. I'm not aware of any statements that Police Scotland has made. However, a significant number of people within Police Scotland must have known on the day that the Deputy Chief Constable gave that information that the information wasn't true. There were people, as you said, the person in the cold case review. He knew that it wasn't a live investigation at the time. He was maybe surprised at the actions of the CCU in taking it forward as a live case. I find it very hard to believe that anyone within Police Scotland with any level of knowledge, particularly when they have a Deputy Chief Constable coming to this Parliament in this committee, giving evidence, wouldn't think to check that it's 100% accurate. I'm surprised that it takes an investigation by yourself, prompted by media speculation to look into this. I would expect Police Scotland to be looking at what you're saying today, looking at all the evidence given at the Justice Committee, and I'm slightly worried that it didn't seek to correct this before an independent report. To answer your question, we found no evidence of that position being carified or changed. We have looked at evidence and I have offered my professional view as to my interpretation of the evidence and what it may have benefitted from clarity. Rona Fawr, from what you said so far, I'm, if I'm understanding correctly, you don't think that there was a failure of leadership within the CCU. Would I be correct in thinking that? I don't think that we've identified a failure of leadership as such. I think that we've identified a number of factors in the report around poor processes in relation to that. We have said and made recommendations that the leadership and the governance internally and externally should be strengthened in the CCU on the back of our experience in this inquiry and looking at wider inquiries. We have also suggested that, in addition to strengthening the internal leadership of CCU and the chief officer oversight of CCU inquiries, there will be benefit in also having some independence scrutiny and oversight of CCU, and we have suggested that the crown may be the appropriate route for that. Do you think that there obviously was a problem and that there was more leader better leadership needed? We would have expected more intrusive supervision of that individual inquiry and more awareness amongst leaders of Police Scotland. In broad terms, that is what you think, how the problem manifested itself. I think that we have said that we have identified that that is one of the issues in relation to the level of oversight that has been given. There were also some other issues that we have identified around processes and procedures within the CCU that led to that as well. How confident are you that those issues will be addressed? I am very confident that they will be addressed in as much as the personal commitment from the chief constable to accept all of our recommendations and understand that Police Scotland is looking to establish a group to bring some independent people into that to take all of this forward. So there seems an absolute commitment within Police Scotland and the Police Authority to address our recommendations and take those forward. You mentioned the Crown and Procurator Fiscal Service doing independence scrutiny, I think that was recommended in recommendation 39. The Crown and Procurator Fiscal Service is also mentioned in recommendation 23 and 25 in terms of data protection, minor offences to corruption, sorting out that very quickly to see if it is a minor offence or if it is a corruption, also in relation to, I think, checking issues, minor offences generally. That is quite a big role for the Crown and Procurator Fiscal Service. Any comments on that generally, given that is the service that we know is already under pressure? I think that it just reflects the legitimacy of the Crown Office and Procurator Fiscal Service in dealing with matters where there is criminal allegations against police officers. In the main, any criminal allegations against police officers would be reported to the Crown. Normally what we are saying in terms of the Crown to Corruption Unit would be benefiting them having oversight of these investigations at an earlier stage. In serious organised crimes inquiry is not affecting police officers. Those arrangements exist and work very well and we just feel that we are bringing them into the counter-corruption world. It would provide that independent scrutiny of them. There is also the issue of more expeditious approaches to reporting minor offences. Is there a backlog just now? Is there a delay in that? What we found certainly from officers is that the Police Scotland counter-corruption unit of focus very much on data protection reaches and has a strict liability in terms of if people access information without legitimate policing purposes. It is a criminal offence and they are reported to the Crown Office and Procurator Fiscal Service. What we are suggesting is that we saw some good practice in the north of England where guidance was given to police around what might be criminal or non-criminal, what could be dealt with as a criminal offence and what could be dealt with by misconduct. We feel that there is value in them being considered in Scotland to effectively allow the Crown to focus on the serious breaches and those minor breaches to be dealt with through potential misconduct for police officers. I have a more proportionate response. Is there a difference in working practice in the Crown and Procurator Fiscal Service or is it just making this more of a priority? No, I think that it is perhaps just going to try and streamline the processes rather than everything being provided to the Procurator Fiscal Service as full cases, as whether or not there can be some discussion between the Crown and the police for a more proportionate response. Which ones are required to be prosecuted and which ones are perhaps best dealt with by misconduct or advice to officers? To have a more proportionate response to these data protection offences is what we are suggesting. Is it more of a front-end discussion that you are looking for then, as opposed to waiting until you have made the decision? I think that it may be for others to develop the processes for that, but what we think would be helpful would be to almost have some abbreviated reporting, a shorter report that would go to the Crown Office who could then look at them and provide advice as to the best way to proceed with them and then push them back into the system if that is required for misconduct. Right. Obviously there is the issue of communication that is something else that you brought up. It is something that has been a thread running through a lot of Police Scotland's problems. Could you comment on that? I think that the issue of a large organisation is the ability of Police Scotland to provide that information out to staff. What we commented on specifically here was the way in which Police Scotland passed out the information around the changes to the code of practice. Well, we felt that they actually had prepared for them and they had passed that information out to staff. Had access to it, there was an over-reliance on email and one of our recommendations is to look for Police Scotland in these particular technical areas to perhaps supplement that by briefings and check that people have received information. Watch the space with interest. Douglas, you had a supplementary. Did you have another question and then Mary? Thank you. I had a few issues. I want to look back at the setup of the CCU. When it was set up, why a whistleblowing policy was not implemented at the same time as the CCU was set up? I cannot, because I was not part of the setup from that in terms of our investigation. Do you think that it would have been useful if it was? We have made comment in one of recommendations that Police Scotland should have a whistleblowing policy. That is looking now three years later. Do you think that it would have been useful for Police Scotland to have had it at the inception of this new unit? Yes. What the policy does is that it would underpin Police Scotland's approach to whistleblowing and then that policy would then cascade itself through a number of other operating procedures that were there, and that is why we have picked that up within one of our recommendations. So do you think that it was an error in the setup, a deficiency in the setup, and were there any others? What we found in our review is that there are a number of policies that are related to ethical standards and things that are still to be finished under review and again one of our recommendations that they should be finished. Yes, to answer your question, at the time that Police Scotland came about, it would be helpful to have a whistleblowing policy in place for them. In fairness to Police Scotland, although the policy was not there, it did roll out their system for which it allows whistleblowing, the confidential helpline is available for that, so that has been rolled out and has been well used in relation to that. Come on to that in a later question. But just based on that one policy, it seems that you are agreeing that there was a deficiency there in terms of the setup. Was there a lack of strategic thinking from Police Scotland in setting up this new unit? I mean, I give an example, page 37 of your report says that you had three detective chief superintendents in the first year and a bit of that unit. Does that seem like an extremely high turnover for a new unit and does that also indicate that there was major problems with the setup? I mean, again, what we've identified, our key recommendation in this is that Police Scotland have to take stock and consider what it is that it wants from a countercorruption unit. They have to reconsider and articulate the vision for countercorruption and we're also encouraging them to effectively look at the structures and create capability for that and that's three years into that. I'm supposed to answer your question in terms of Police Scotland at the time. They rolled out the countercorruption unit, they set some parameters for that, but our view is that three years on they need to go back and look at that and be more clear on what they need to do. The turnover of staff, that's a lot of staff to turn over at a senior level and I think that we've identified that that has had an impact on the way that the CCU has developed. It's also had an impact. Paragraph 103 of your report says back in 2013 when this unit was set up, it was asked to identify potential and emerging strategic trends, yet we're still waiting for that to come to limited exposure in summer of 2016. Is that really acceptable that a unit is set up and asked to deliver that to a deputy chief constable back in 2013? We're still waiting for that to be delivered and who within Police Scotland should be looking at this? It shouldn't take a report from yourself which, as I said earlier on, is very welcome to highlight that something that was asked for three years ago has still not been delivered. I agree to the extent that strategic assessment is an extremely important document. It helps Police Scotland to understand the threat that they face and understanding that threat they then configure their countercorruption to deliver against that, so those are all key documents that we would have expected and we've made recommendations for them to be put forward. Finally, Paragraph 93 suggests that you support the fact that the number of people involved in the unit have some experience and a broad range of experience, but they are able to get specialist technical support from across the force to the CCU, yet earlier in your report you highlighted that as a risk, because more people are aware of the investigations of the CCU. How do you marry up those two quite different recommendations in your report? It's probably two things for me. The first one is a recognition in our report and a key recommendation that Police Scotland needs to have the capability and capacity to tackle proactively countercorruption investigations. In order to do that, they should have access to some specialist operations that they can use to do that. It might be helpful at this point to introduce John Young. John Young was Head of Professional Standards and Interruption Emergency Police and is now an associate inspector. John, perhaps give an idea of what the model was in Merseyside Police and how that might be the model that would suit Police Scotland. In Merseyside, I had a PSD, which also had the countercorruption unit. The countercorruption unit was very much self-sufficient. If you looked on a hierarchy within the force, they could look at anything that the rest of the force was doing. If we wanted to put surveillance out, I didn't need to go and bid for other resources. Past the problems that you've got with countercorruption is that corrupt police officers only act corruptly for a very small percentage of the time, so you want to be able to dedicate resources to looking at them. In relation to that, we could put out our own surveillance. If I needed to get technical support, but because of the sensitivities of the investigation, I didn't want to use our own technical support unit. I could go to other forces, I could go to the national crime agency. I didn't really need to go anywhere else to get the work that we needed to do. Although the countercorruption unit does not have that capability in Police Scotland, it is providing the reassurance that Police Scotland has that capability, so, if it is required, it can be accessed currently. Two other quick issues. In terms of integrity matters, the IEM reporting system comes across in your report as being a success, because it was two to three people who were phoning up a month on the anonymous phone number that 11 to 12, maybe a month, are reporting through emails. I see that as progress and welcome, but I'm slightly concerned—maybe you can allay those fears—that there are plans now to have another system within the IEM. At the moment, if I sent an email to the IEM address, it would automatically be deleted, so the person receiving that doesn't know that it was myself—Douglas Ross, PC and the Scottish Parliament—who put in that report. Now there is a proposal to have a system where there would be two-way dialogue between the investigator and the person submitting that. Is there not a risk that that puts people off reporting confidential matters? Yes, that is a short answer and one that we have identified in the report. Should that be developed, what we have said, there would have to be some very strong technical safeguards. It would have to be tested to make sure that that anonymity was provided. We would share your concerns around that. There are systems that are available that allow you to do that, where the forces have got them. I could point Police Scotland in the direction of them. The way that the software works is that, yes, people have to log into a system, but they get a password. The password goes through, so the people receiving the information get a password. They will answer back. The only person who can gain access to that is the person who has got the password at the other end. If they never access it, they will never see it, and it is impossible the way that the systems are configured to go back into it to find it. Yes, there are some forces that have systems where they can go back and you could potentially question whether you could find them, but there are things out there on the market that you cannot ensure people's anonymity. You can start that dialogue, because once you start the dialogue, you can then potentially reassure the person involved, put support around them and get the necessary information so that you can progress you at your corruption inquiry properly. Although if the corruption inquiry is dealt with properly and there is effective outcomes, then the person, the anonymous person, can see those outcomes. I was going to ask whether you found anything in your report that would suggest that the CCU is not getting enough information from that initial anonymous inquiry that has led them to either not being able to follow through in a report to require this extra information, because even with that answer from Mr Young, I still have concerns that it will put people off. I think that to follow the theme of putting people off, that's what I think. We've been clear that if these enhancements are added out, they really would need to be thoroughly tested. I think that staff would need to have confidence in using them. The testing has to be done. I am also suggested that staff associations would need to be brought in around that. In relation to your general question about whether there is enough provided within the integrity matter report, that will vary in terms of the information that is provided. At best, it will be anonymous information that would identify potential corruption or misconduct. That would then lead the CCU to do more work around that, but it's a fair point that you raise about those who raise those matters, seeing things happening around them. If I could have a final point, convener, recommendation 36 relates to the progress of the vetting section. Progress hasn't been very good, has it? Although our focus was on the CCU, we looked at all the various functional sections within that, and vetting was one. Clearly, there's a backlog within that for vetting applications. Although I do understand that we look to prioritise the vetting almost on a daily basis as to what has to be done to get through that, we have added more staff in to clear that. However, we have identified that there is a backlog in that. That backlog is being addressed. The backlog quickly on the train this morning has gone up from 3 per cent to 9.6 per cent. That's a big increase. I ask who oversees this. Someone in charge of the CCU unit who presumably says, look, my staff are too busy. At what level does it go up to within Police Scotland, or does the SPA look at that? Presumably, it looks at figures on a range of things every month or every time they meet. Since September 2013, the fact that it's gone up from an average 400 a month to just under 1200 a month outstanding applications, I think that that should be raising alarm bells. Again, it seems that nothing has been done until your report. Again, the extent to which it's been scrutinised internally or put to the SPA, I'm not sure who didn't take that part of our review. Did you see any examples of them trying to scrutinise this before? Not in terms of the venting side of it. That's why we've made a recommendation that the update should be provided to the Scottish Police Authority. What we have seen is there's been some additional resources put into the venting unit and we're comfortable enough with once they're trained and access to the systems, then they should start to work to reduce that backlog. But the SPA hadn't highlighted this as a concern before now. Not at this stage, not during our review. Can I just ask you a couple of questions about procedure? I wonder if you could clarify the procedure for submission, deletion and resubmission of applications for communications data. Yes, the Interception of Communications Commissioner's office released memorandums and annexes there last week. There's an investigatory power tribunal that will be going ahead on 22 July. In terms of providing some explanation here in relation to the acquisition of communications data, the counter-corruption unit working hypothesis was somebody within a media investigation team who was leaking information to a journalist in relation to it. We know that that hypothesis was flawed. Part of their investigation was to identify who within Police Scotland was actually leaking that information out. They went very quickly in our view to applying for communications data, which was subscriber details, itemised billing, etc. The first application was presented to the designated person, the detective superintendent, who was a trained authorising officer, well experienced in covert authorities, etc. He was independent of the counter-corruption unit investigation. He was independent and never worked on the Emma Caldwell inquiry. His job is to look at those authorities and to make a decision based on the evidence presented. The first application contained details of our journalist's telephone number. He was aware of the code of practice. He had been briefed on it. He sought advice from the Central Communications Investigation Unit within Police Scotland in terms of, does this application require judicial authority based on the revised 2015 code of practice? He was given clear advice that the answer to that was yes. He then returned that application and sent it back to the counter-corruption unit intelligence section. They deleted the journalist number from that. They then presented that application again without the journalist number, along with two additional applications to the designated person, the detective superintendent. He read them, did not seek further advice from the Communications Investigation Unit and unauthorised them. They went through the process. There was no requirement based on the processes in Police Scotland at that time for him to seek advice from the Communications Investigation Unit or the senior responsible officer. That process is changing now. Police Scotland has put measures in place, which the Interception Commissioner has commented on, are robust and should prevent a recurrence of what happened. The three applications that the designated person signed carried through the process have now been subject of inspection by EOCAL. Police Scotland has conceded to the fact that it has breached the codes of practice in relation to that. That is why we are with the Investigary Powers Tribunal in terms of remedy for those individuals whose article 8 human rights were breached. When you said that there was no need for them to go through a oversight process when they resubmitted the applications, was that the standard procedure? The procedure was a designated person and there is an annex to learn a report that the law states that a superintendent has authority to authorise communications data, particular traffic data and inspector can authorise subscriber data, which is at a lower level. There was no requirement to seek further advice from anybody. That was the processes in place at that particular time. He did not breach any process where the contravention of the code of practice kicked in. Rapa was not the process to apply for data in respect of journalists or to try to determine a journalistic source. That required judicial authority. Could you perhaps clarify when you said that there was no evidence of chief officer involvement? What level are you talking about when you say chief officer? I am talking about chief constable, assistant chief constable and deputy chief constable. There was no involvement of any of that level. The executive of Police Scotland was not involved in any aspect of the applications. The applications went from the counter corruption unit to the designated person who was a superintendent and authorised them as per the processes that were in place. There was no oversight nor should there have been at that time of any chief officer. That was routine business, other than the fact that if you remove the judicial authority bit, which was new, the applications and authorisation of communications data, it is routine business for policing and it sits at a superintendent level, which is a senior level within the police service. There is no intention to change that. It will remain like that. No, that has changed. In terms of judicial authority, any applications in terms of seeking a journalistic source will now go to the senior responsible officer who will ensure that the proper routes are in place. If there is a requirement to do that, there will need some sort of judicial process, which has only recently been introduced into Scotland based on a letter from the Lord Advocate in April this year. Will there be any review or ongoing oversight to ensure that all the procedures are correctly followed in the application for communications data? I am understanding the interception of communications. The commissioner's office, who has the authority for this, is actually in Police Scotland this week doing their annual inspection, as they do every year. Will recommendations perhaps be made from that? They will do their inspection and if they find anything, they will make recommendations to Police Scotland. Are you content that the correct processes are now in place, that there will be no further breaches? I can quote from the commissioner who has satisfied that the processes in place now are robust to prevent a recurrence of that particular scenario. If there is a requirement for judicial authority, there are processes in place to ensure that they will be adhered to and the code of practice will be adhered to. Given the concerns that a number of officers have been subject to CCU investigations that are picked up around page 9 of your report, is it possible for the CCU to regain legitimacy among SRAN-confile officers? It is important that it does, in fact. It has to do that, which is why our comments are that the CCU has to operate with the same ethical standards as the rest of the force does and behave in the same manner that the police officers do. It is what we picked up from in speaking to those officers who have been subject to CCU inquiries, where a lot of their experience predated Police Scotland and was predominantly legacy strath Clyde, although clearly some of that culture had come across into Police Scotland. It is something that Police Scotland is aware of in terms of the perceptions and, as I understand, are working to overcome. However, the legitimacy of any CCU unit within a force relies on being seen to be credible and fair amongst the staff that it works with. Given that the CCU has fallen significantly below those standards and Police Scotland is a relatively new organisation, do you think that there is any argument that it would be better for the CCU now to be disbanded and to start from scratch or to build another model that took into account the various points that your report outlines? As I said, we are in the business of identifying improvement and hopefully our report sets out a clear path for improvement that Police Scotland can take. Our key recommendations, as I said earlier, are very much about Police Scotland to be clear about what it wants from a counter-corruption unit and then to restructure that counter-corruption unit to provide the capability and capacity. For us, there is very much an opportunity. In fact, a request for Police Scotland to do exactly that is to take a complete review of its approach to counter-corruption, looking at best practice across the country and to develop something that is fit for purpose and fit for its needs. In your professional view, do you think that the current CCU is the best starting point for that process, or do you think that it is better to take a step further back from that and begin from scratch? I think that the CCU, as we saw, is providing a function. Its function was around a low complexity, low volume activity. We think that it needs to do more than that. I think that it provides what Police Scotland is looking for at the moment, but our recommendations are very much firmly rooted into a structural review of counter-corruption within Police Scotland. On that, if you are saying that you do not think that it should be disbanded, what plans do you have to scrutinise that your recommendations are being implemented? Is there an on-going plan for that? We ask Police Scotland for an action plan. I wrote to the chief constable yesterday with a copy of a final report that made a request for an action plan to be provided to us. We also ask that the Scottish Police Authority will take an active interest in overseeing that as well and how it will work, as we would work alongside Police Scotland as we start to implement those changes, so that we can make sure that our expectations from the report are carried forward and provide that assurance to the Police Authority that the improvements that we are looking for have been made. On the Scottish Police Authority, could you comment on its role? Could you have been with hindsight more proactive in intervening here and monitoring what was going on? I would praise the Police Authority when it raised its head on the media and parliamentary interests. That was the point that I think that it shone some light on to the CCU and it made the request for us to do that review, so I think that that was helpful. What we have identified in the report is that there is a need for the Scottish Police Authority to be involved in the discussions generally around how it strengthens the oversight of the CCU and I think that that would be about them being provided with regular updates on the general work of the CCU and the point that Mr Ross made about things like vetting and other management information being provided to them so that they can effectively assure themselves that it is working effectively. What would you consider regular? I think that it has to be built into the existing board scrutiny, so it has a sub-committee structure that should be taking the reports as part of that normal business. I think that there should be an interest in the Police Authority in its public board meetings about the progress of the review. Thank you, Mr Penman, for coming along. It is actually from a near-point. I would like to hear what your plans are for testing the enhancement that you mentioned in order to provide confidence in staff reporting issues. It is probably specifically in relation to Mr Ross's question about any enhancements that might go into the system to allow communication between people who initially make a report, is that the area that you are interested in? Yes, I should clarify so that it was actually a supplementary at the time of Mr Ross's question. No, I think that for us, it is without knowing what those proposals are, it is difficult for us to say. I think that what you are saying is a principle is that any of those enhancements are made to the system and I understand the system that Police Scotland has built in-house, so we would be seeking for them to demonstrate to us and to staff associations who have an important role in this that the system does have the integrity and the safeguards built into that. Our expectations and the follow-up of our recommendation would be if Police Scotland are doing that, we would want to know in some detail what those changes were and what safeguards they have put in place. For clarification, there are no substantial plans at the moment. We are not aware of any detailed plans moving forward. There was a view that it would be a helpful enhancement in those discussions around enhancement, but we have not seen any detailed plans around that. That is why we have identified the report and the need for safeguards. Just on a different point, on page 13 of the report and the planning and process, you have a point mentioned there about the number of personnel on restricted duties. I would just like to get an idea of the scale of that. Is that an extraordinarily high number? 700 days seems like an awful long time, and it was just really to get an idea, like I say, of the scale. In the perspective, there are more than 17,000 police officers in Police Scotland, but there are 140 officers who are currently subject to restricted duties. As we have identified in the report, there is validity in having officers on restricted duties if there are some on-going investigations or concerns around their access to information. Our point is that 29 of them have been on restricted duties for over 700 days seems a while. We did not go into the detail of individual cases, but I have spoken to staff associations and officers who are subject to those restrictions. There is a view that Police Scotland could review that and see if there are opportunities to relax, deal with the cases that have outstanding against them and perhaps allow them to go back to full duties, because it is effectively still 140 police officers who are not available to serve their communities fully. How would that compare to other police authorities that are well across the UK, such as England and Wales? Do we have any comparison? We did not do a comparison in relation to that to see if it was more or less at the time, but for us, just looking at within Police Scotland, we felt that there is some scope to review those cases, certainly the ones that have been over 700 days, to see if they could be expedited. John Finnie? In your key findings, you talked about, in a quote here, our examination of CCU intelligence files has raised concerns over the routine management oversight and wider governance of CCU inquiries. That is the bit that I wanted to comment on, including the extent to which chief officers are actively briefed. Yet, in the executive summary at the bottom of page 6, you say that there is a clear responsibility for police officers and members of police staff to keep themselves abreast of new legislation and guidance. One suggests proactivity on the part of the junior orders, but the chief officers are being briefed. There was an issue about who became aware of the new changes to arrangements. How does that fit in with all the plethora of legislation that police officers have to do? I think that the key finding in relation to chief officers was for us an expectation that there would be greater scrutiny of individual counter-corruption investigations by chief officers, so a greater awareness of the detail behind those investigations. From that, we took the opportunity to go down to Merseyside Police, where we were impressed at the extent to which chief officers took an active interest in the specific investigations that lines of inquiry have been followed. We felt that that was something that could be strengthened, so the initial finding was in relation to that. On the general principle of a clear responsibility for police officers and members of police staff to keep themselves abreast of new legislation, how would that take place? Again, in the context of that, the people who we are referring to are those who have specific specialisms. For example, part of the training of designated persons is to say that they have a responsibility to keep themselves abreast and keep them aware of that. They have access to an intranet that provides up-to-date guidance, and there is an expectation that those officers—not everybody in Police Scotland but those particular specialisms— have a particular onus in them to keep themselves skilled and up-to-date in relation to that. Those resources would be provided for them to keep themselves abreast of legislation changes. Police Scotland would then pass that guidance out. What we have said is that Police Scotland has relied on email communication, and she has strengthened that to ensure that those who are provided with information, if it is critical, understand that and have received it. Whose responsibility is it to clarify that all staff are fully obeyed with the most recent legislation? In the general terms, it is an organisation of responsibility to make sure that the staff are aware of legislative and organisational change. Many thanks. Does that include the option for the audio record, which is mentioned in recommendation 26? You are suggesting that the SPA should have at least a working knowledge of what is going on there. The audio recording is specifically to advice and guidance briefings that are provided. That is where there may have been concerns around a police officer or a member of police staff, but it does not mean to criminality or misconduct, so there is an opportunity for the counter-corruption unit to speak to that member of staff and address what those issues are. The system in place just now allows some of them to be recorded, if the member of staff wishes them to be recorded, to provide some safeguards. Our recommendation there was again that that does not exist within an SOP currently, within a policy, and there is a need to embed that through. Our interests for the authority and staff associations are to make sure that when the SOP is done, around those briefings and the audio recording, that they have a view of that. The other view would be to say, can you have all of these interviews recorded to make sure that there are protections for everyone, but the feedback that we got from staff is that that might be disproportionate. In relation to the audio recording, what we are saying is that recognising that it probably should be done at the discretion of the member of staff, but it should be within an SOP and the staff associations and SPAs should be involved to make sure that that is what the staff and staff associations would like. So, there is definitely a role in SPA in monitoring what is the proportion that balance. I think that there is a role, as has been accepted for the SPA, around this whole area of counter-corruption. In terms of accountability, the chief constable is responsible for the policing of Scotland and the authority is responsible for holding the chief to account for the policing of Scotland. My view would be that counter-corruption is part of the policing of Scotland, therefore it is legitimate for the authority to have an active interest in that. There are a number of people wanting in, but I am going to take a bend mix, because you have not had the opportunity to ask a question. Thank you, convener. Just in elaborating from what Oliver Mundell said about the confidence of rank and file officers and moving forward from what Duncan Ross said about the lack of previous policy on whistleblowing, I wondered if you could just comment further on recommendation 20 and your views on the importance of establishing a formal whistleblowing policy. I think that it is key that there is a whistleblowing policy, because then staff can understand what is the position of Police Scotland's organisation in relation to whistleblowing and, importantly, what safeguards and what protections are available to staff to give them the confidence. We know that Police Scotland is actively pursuing the whistleblowing policy and is looking to work with the private sector and public sector and to identify best practice, so that is work that is on going. The new chief constable has given a firm commitment towards that. The whistleblowing policy is very important. It will inform a number of other standard operating procedures moving forward. Integrity matters, which is a current online system that we feel is an improvement from what was there before, and staff are obviously using it, but we have also suggested that there might be opportunities to have another external system that would allow officers or members of the public to report any whistleblowing as well. We feel that whole area is something that is worthy of further thinking and review. In terms of what the recommendation says, it suggests engagement with staff associations. Can you elaborate further on that? I think that it has gone back to my initial point where the Intercorruption Unit must have legitimacy to operate, and that legitimacy comes from adopting the same ethical standards as the officers and police staff that it is effectively policing from there. The staff associations are the voice of all the police officers and police staff earlier, so it is really critical that they are involved in developing some of the policies and procedures around whistleblowing in particular. For staff to have confidence in countercorruption and whistleblowing, the staff associations have to have confidence in that as well, so we see that it is absolutely critical for the role of the Scottish Police Federation and the Superintendents and Unison and others to be part of the discussions around that and to be satisfied themselves that Police Scotland will protect those who provide information on their whistleblowing and what is provided that will be taken seriously. In terms of the overarching policy, do you think that there are any specific considerations in light of your report and the general workings of the CCU that would need to be considered in that general policy development? I do not think that there is anything in terms of the whistleblowing policy for us. We suggest that there needs to be safe cars in terms of integrity matters. We have made recommendations to improve the internal oversight of the CCU, to improve chief officer's right of the CCU and we are also suggesting that there should be some external oversight scrutiny, so I think that all of that, hopefully, would give confidence at what the CCU is doing. There is greater transparency and accountability over that, so I think that that is quite an important feature for us as well. I just go to two other issues that I had highlighted. Recommendation 5 suggests that there should be a more structured approach to communicating changes in legislation, which John Finnie was going over, but just in regard to the Regulation of Investigators' Power Act 2000, do you think that there is a need to do that further? I understand that the report is just about the CCU unit, but if there are deficiencies in disseminating information to that one unit, do you think that there could be deficiencies in other areas of Police Scotland and is that something that the SPA or Police Scotland should look at approving across the board? As you pointed out, we intentionally kept it very narrow in relation to the RIPA and RIPSA, and that is also because the people who are trained in that have a responsibility as well. I think that, as a convener, I highlighted earlier in one of our questions that this has been a recurring theme in terms of Police Scotland is communicating out change in particular to an organisation that spans the country and has over 20,000 staff. It is something that they are aware of and we have made comment and recommendations in our previous reports about strengthening communication from staff and making sure that staff are aware of changes in particular. Have you seen any progress with that? I think that we have in terms of Police Scotland are developing their internal communications policy and they are also taking feedback from their staff's survey for that, but in terms of us physically going in and checking it, we have not done that. The action plan and review the action plan, when you see recommendation 5 has been sufficiently dealt with, do you think that the SPA should use that as a model across all divisions within Police Scotland, or do you think that that is very specific to the CCU? It is specific for the CCU, but I think that you raised a valid point where the SPA and Police Scotland might see an approach to that. That might be something that is worthy of rolling out. Conversely, they might have rolled out some stuff already, it is working quite well for them that they could bring into that. However, I think that you raised a general point about the authority in Police Scotland being mindful of the difficulty in communicating out, in that case, quite complex legislation. My other question was on paragraph 194. Can I ask how many super-users there are and how many super-users you feel there should be? To be honest, it is an answer. I do not think off the top of my head. We know that it was the general principle of the fact that Police Scotland was still working their way through that, and there was a potential vulnerability in terms of systems to be tied up. I do not think that we have actual numbers from that. You say that there are too many, and it should be reduced. What we are saying is that those super-users who have access to the back door into ICT systems are properly vetted, and that work is still on-going, so it is a matter of priority that we are asking for that work to be progressed. I am quoting you from your second line of paragraph 194. We consider that this review is important in identifying and reducing the number of people within Police Scotland. Therefore, if you are saying that it must reduce, you must know how many there are for it to reduce. I think that the comment in terms of reduction is the fact that I think there is an exception in Police Scotland. I would not get the numbers if there were some people who would have had access in previous roles to super-user functions that may no longer need them, so the view being that there are people who have it who no longer require it for their functions, and the reduction was based on that basis. How are you going to gauge recommendation 37 if it has been successful or not? If you do not know the number from when you made that recommendation to when you reviewed that recommendation, I do not know how you can— Because we would expect Police Scotland in terms of recommendation to demonstrate to us how many there are and how many there are now and of those who have been done— But you did not ask for it during your report. I think that that is strange. Well, again, I suppose in terms of the span and scope of what we did within our report, then we identified it as an issue and a potential vulnerability for the Police Scotland. Super-user is quite a big part of your report because it could have been a super-user who was involved right at the very beginning if it was a member of the police staff. As I said, we identified the vulnerability. We reported on the vulnerability to answer your questions on how we would track the recommendation. It would be by looking to see specifically what have Police Scotland done to identify who were the super-users and how have they rationalised that down. The comment in relation to reducing it is an acceptance that people will have super-user rights across some systems that would have been given to them in previous roles, and it is about tightening the procedures and processes up when they move on that those rights are taken away from them. It is a general principle about reducing the number that they are just now because people would not have access to it. On the numbers, we do not have the numbers that were there, it was just identifying a vulnerability within our report. Are you satisfied that you can then follow up on recommendation 37? Yes, because we can go back to Police Scotland in the specific area, one of 39 recommendations, and actually look to see what they have specifically done. My expectations would be that they will have identified the time we go back, who are all the super-users that are there, how many of them do not need to have access to those systems, and how many of them have been reduced. For those who remain, what processes are in place to make sure that they are properly vetted and have a legitimate need for that super-user access? So what rank and above do you think should be super-users? It was not for me to determine what rank it would be for that, it was for Police Scotland to determine whether the person who has the super-user access has a legitimate need for that access, and for them to demonstrate to us arguably who may discharge this recommendation. So just to get this correct, you are not telling Police Scotland how many to reduce by or what level they should be. You are leaving it up to them to tell you it is reduced from a number that you do not know what it is to a number that you do not want to specify because you do not know the original number in the first place. No, to clarify your position, what we have done is we have identified a vulnerability here where there are potential super-users or there are people who are super-users who have access to systems. There is an acceptance that some of them perhaps should not have that because of their jobs have been changed, and we have asked Police Scotland to go through and rationalise that down. I would expect that in following up the recommendation, Police Scotland will demonstrate to us who are all the super-users, how have they been reviewed and justified the need, but also have a process in place to manage that going forward. On the supplementary. What sounds like quite a detailed conversation that you have had with Police Scotland regarding super-users, did you ask for the number of people who had access as part of that conversation? No, because it is the same thing that we are doing. This is one area across a number of areas in the CCU that we had picked up a potential vulnerability, so it was within a report identifying that vulnerability, knowing that Police Scotland had already identified as an issue, and they were working through that. Would you have confidence that Police Scotland had any oversight or any firm idea of who had super-user access, or do you think that that was just something that was unknown and unchecked? What we found is that Police Scotland had identified that they are aware of it, and they were already in process of working through that. Are they aware of the issue, or are they aware of all the super-users? They are aware of the issue, and they are working towards that. What that looks like is that Police Scotland has a finite number of IT systems. They would then look at who are the users of those systems, and of those super-users who have access to it, and then going through that process will identify those who currently have that, and then a decision can be taken on whether or not that should remain with them, and if it does, for protections that are in place. We did not go into that level of detail in our report. We identified the issue, and we are satisfied that Police Scotland will go home. From the conversations that you had, could you be confident that they knew all of the individuals who had super-user access, or was it a suggestion that they had a number of IT accounts, and they did not know who did and did at any time have access to that system? They do not know exactly who has super-user access. Individuals staff have different levels of vetting. That is a review in terms of who are the individuals now, what is the level of vetting, and they are reviewing that element to make sure that it matches up in terms of access to systems in level of vetting. So we are comfortable on that. They know the numbers involved. They know the individuals involved. Some of the different levels of vetting across the board is about rationalising the vetting with those individuals, and I think from that we will start to see a reduction coming down. Do you think that that information you will be able to make available to the committee or to request now from Police Scotland? Yes, I think that Police Scotland should be able to provide that information in terms of the numbers that are super-users on the vetting levels. Thank you. That would be helpful if we do not know the starting point of the number of super-users. It is impossible to say if they have actually complied with recommendation 37, so we would appreciate that information. Now, I think that we have got a supplement well. Was it on this point or at a different point? It is on timescales, just while we are covering, if you do not mind. Yes, it is just a very brief question on timescales in relation to all of the recommendations. Now, I accept that you may well say that it is up to Police Scotland to set the timetable for carrying out the recommendations in this report. But at what point will you be reviewing it? Excuse me, will there become a point when a recommendation becomes a requirement? How will you monitor the recommendations that you have made? In terms of the timescales or standard approaches, we asked Police Scotland to provide an action plan within three months as a normal timescale for us. As I understand, in this case, Police Scotland and the chief and the authorities are looking to develop that as soon as possible for us. I imagine that we will have the action plan before that. In terms of our follow-up for this, we would be expected to be when Police Scotland are working through the recommendations once they are finished or feel they are completed. They will come back to us and we will come back in and will review specifically whether we think that the action they have taken discharges the recommendation. If we think that it does, then we will discharge the recommendation and the police authority will know that. If it does not, then we will provide further guidance to them to help them to work that through. But when you say, you will wait in Police Scotland coming back to you, you do not have a timeline in your head for an expectation of the recommendations being implemented? What we have said is to ask the chief constable to come back within three months around the action plan for that. So again, it is getting behind the detail of the action plan and being realistic about what Police Scotland can provide and the authority will have a view of that as well. I am sure that both the chair and the chief constable are keen to expedite that. From our perspective, we ask for an action plan within three months. We will then work with Police Scotland as they discharge the recommendations to see that they have been done. We do not wait until they are all done. When Police Scotland says that we think that we have done this one or that one, we will go in and we will look to see what has been done in that regard, and then we will report back to see if it has been discharged. Is there a process of on-going review? Yes, effectively. However, that would come from Police Scotland and the authority keeping us updated on the progress against the action plan. Okay, thank you. Stewart Stevenson. Thank you very much. I will be briefer than intended. Mary has covered me. No, no, no, it is all right. As long as somebody does it. I really just going to make an observation and then allow us to move on. 33 years ago, when I worked in IT and had special licence from the US Department of Defence to use software that was described as munitions of war, we were not allowed super users. We had to dual or triple authority. So the idea that we still rely on super users in the modern age seems to me a very, very antique idea. And I wonder if you might explore generally the introduction, which would have to be faced of a process by which it is dual authority. Because it is all very well somebody very senior vetted to the eyeballs can be exposed subsequently to an event that leads to their sub-bawning, their rights as a super user. And the best way is always to have two keys to something rather than one person with a big key. I just pass on. I think this, you mean again. I'm obviously picking up the committee's interest in super users and again something that we will take away from this and go back as part of the action plan, this recommendation and perhaps strengthen our scrutiny in that area. I suppose to put into some perspective that this reflects Police Scotland being an amalgam of eight to ten ICT systems that are legacy systems. Some of these legacy systems were developed in-house, which means they don't have an auditing capability to put into them, which means if the counter-corruption unit are asking for some things to be done, it requires effective administrator rights rather than super users, perhaps a better expression, to go in and actually mine information because it's not readily available. That's in some systems and not all. And again, the ICT systems hopefully develop around that, that will improve. We've also supported or recognised the interest in business monitoring software that effectively sits above all the systems and allows audit of all the systems being used for officers. We see that as being something that should be expedited as well. Sounds like something that I've developed and put in the public domain 40 years ago. I've got John and Oliver. Is it a supplementary John? No, it's slightly different. A supplementary Oliver. I'll go back to an earlier question. Okay, I'll bring John in then Oliver. Okay, thank you. With regard to the passage in your report, Mr Pennell, when you talk about user focus and the concerns that officers have expressed about the lack of transparency within the counter-corruption unit, and I quote you here, and frustration by officers that when they raised complaints against CCU officers, they were not taken seriously or independently investigated. That's a very serious matter. Are you able to say how many outstanding complaints there are and what the nature of them is, whether they are criminal or misconduct? We met 11 former officers along with the solicitor who represented them from there. We made it clear that we weren't going to look at individual complaints, so I don't have the answer as to how many complaints. What we were keen to do was to try and understand any common themes around their experience that we've put within the report. What we have done on the back of that is to make a recommendation about increasing the independent oversight of complaints against counter-corruption unit but also that there's a need to make sure that those outstanding complaints are reviewed and there's an independent element to that as well. But the actual numbers and detail we didn't go into that with the individuals concerned. Of course, it's the case that there would be independent oversight anyway if any of those allegations were of a criminal nature, because the... There would be independent... Independent of the Crown, I think that what's needed done is actually probably to look at all of these outstanding cases where people remain dissatisfied and just see to make sure that they have all gone through all of the avenues that they should have gone through and that they've been properly in the bus that they dealt with. Given the importance of that matter to the general confidence, there should be about the methods that are in place to deal with corruption. Have you been given any early indication from Police Scotland whether they are acting on this matter? Yes, my understanding is that Police Scotland have been already communicated with the solicitor and given the commitment to look at these. Many thanks. On that issue on... If there is a complaint issue depending on the nature of the complaint, would the officer automatically go on to restricted duty? What the process that happens and does happen is that the nature of the complaint would dictate the risk to the organisation. And if the complaint was such that there was no risk to the organisation for the officer continuing in their normal duty, then they shouldn't be placed in restricted duties. If there was a concern that actually they might access information systems, well on duty then the restricted duties might be to take access away from those systems. Or if they feel actually that the officer can't be involved in front-line policing, then they could be taken away from front-line policing. Ultimately they could of course be suspended in relation to that. So what good would look like is Police Scotland doing an informed risk assessment for each occasion to work out what is the risk to them and the risk to the officer and then put restrictions or protections around the individual case? Is there a concern that presently there may be people on restricted duty that shouldn't be? I think that our view is that it would be worthy of Police Scotland now with fresh eyes taking a review of what they have in restricted duties to see if they can release people or if they can deal with the cases that are outstanding against them. Because there's two issues here really, isn't it? There's the fairness, there's the proportionality, there's also a financial implication quite a big one, I would have thought, because are they in full salary yet they're totally redundant to the police force? I think that it's a valid point. I mean effectively what it does if it's 140 officers who are on restricted duties, then in some cases it means they're not able to deliver services to communities. Now, there might be legitimate reasons why they can't do that. What we are saying is that it needs to be risk-assessed in an individual case. And I suspect where possible they should be returned to doing those duties if there's no risk to them or the organisation. Okay, Oliver. Just very quickly, leading on from that, would be put under restricted duties unfairly affect their future career prospects? I think that you raise a valid point and that is at the point that once people have been subject to counter-corruption inquiries and if they've been proved to be unfounded to make sure people aren't tainted in any way from that. So, and that's about, again, having processes and practices that demonstrate that that is the case. We are confident in those processes. We didn't look at them in detail. I think that there would be a perception in the organisation from the users we spoke to that if you're investigated by counter-corruption then in some respects you're tainted. I think that I made a quote when speaking to officers or the worst thing you can do to police officers accused of being corrupt. It was a really powerful quote that came from one of the focus groups that we read. But I think that, again, it's incumbent upon Police Scotland where these allegations are investigated, found to be unfounded, that actually is demonstrated by the officer in terms of their progression. Okay, Doke. And in terms of going back to the 140 officers and kind of related to Mary Evans question, I just wondered, given the comments on page 15 of the report that there were particular concerns during the transition period regarding Strath Clyde police, wether you'd made any assessment of where the 140 Police Scotland personnel who were on restricted duties were based or stationed? No, I don't think we did, but we did this information that we got from Police Scotland around that, so in terms of where they were across the organisation, I'm not sure. Indeed, I'm not sure if any of those cases could even have been legacy cases that existed since that time. Again, our intention would be that the review by Police Scotland coming in would identify that and where appropriate release officers back to full duties. Again, do you think it would be possible to have figures from Police Scotland about where the officers concerned were based? It's certainly a request that the committee could make of Police Scotland. I would imagine they'd be able to provide that information. There's one concerning aspect that I'd be grateful if you'd comment on. It was pointed out that the procedures relating to the seizure handling and management of CCT disc butage, including recording, lodging and storage as outlined in Police Scotland's standard operating procedures on productions, had not been adhered to and evidence had been lost. Yes, Police Scotland has a standard operating procedure that relates to the handling and recovery of CCT's evidence. It's not uncommon for inquiries where CCT's evidence were taken from public space premises and for that, what we found with a particular interest in this case study around evidence that had been obtained and when we asked for that, we discovered that that evidence wasn't available and had been lost. When we looked into that, clearly the procedure hadn't been followed, which led us to making a specific early recommendation to Police Scotland to investigate the circumstances surrounding that. What implication would that have? How far does that go if you thought they had the evidence and then all of a sudden, at what point does it become material that you haven't got it? What's the implication of that? From our perspective, there's a degree of professionalism that we would expect within policing and within the counter-corruption unit, and that would be that any evidence that obtains follows the same standards that the rest of the organisation would follow in terms of recording that information and they have fallen short of those standards in this case. Is there any suggestions that there was a willful loss of information or is it just not being efficient? I mean, how is this come? It seems to me quite germane. We didn't go into the detail of investigating the circumstances surrounding the loss when it was identified and it was clear that the procedure hadn't been followed. Then I wrote to Police Scotland to make him aware of that and asked him to investigate it separately. How do they record and highlight any information that needs to be made secure? Basically, it's routine business across Police Scotland. If somebody's asked to do something, I know it's taken up. Officers go and see the evidence that comes back and it's lodged through a production book and part of the standard operating procedure. We see that across Police Scotland operating really well. On this occasion, it was a counter-corruption intelligence section when it seized some CCTV from my public space and their processes weren't robust enough and they've lost it. So that's huge implications both from access to justice and so many other things. How widespread do you think it is then? Did you delve any further to this? I mean, it prompted us to look at the whole evidence handling, production handling across the counter-corruption unit and looked at that and there are robust processes, albeit not consistent processes, in place across the country for counter-corruption. But again, because it wasn't recorded in the first place, it's difficult then to identify things that haven't been recorded if you come and do an audit in relation to that. Certainly, there's no evidence for us that it was a widespread practice, but could we, in this case, when we asked for it, it was not available and there's a significant shortcoming that we identified in terms of the processes and procedures. And there was last thing about the administration, administrative burden, I think. There were things that you felt could be dealt with in a better way. Would you like to elaborate on that? It's just a general point, I think, as we found. It goes back to what Police Scotland has been clear about what they want from ACCU in the organisation. At the moment, it's doing a lot of background checks into individuals for various things around retirement, promotion, medal awards and things like that. So there's a lot of time taken in doing that. It's picking up a lot of work from its service integrity where it's out basically where people are given notifiable associations and relatives and friends that they have and they're being checked up and there's a lot of work being done in what we would consider to be a low-level data protection. So our view is although those things remain valid, it's whether they remain valid for our counter-corruption unit and our view would be that the counter-corruption unit should be if you like, not involved at that low-level activity but should be focused much more about proactive serious corruption and I think that's where they should be configured and where they should concentrate their efforts. Okay, and Douglas, I think we're just about coming to the end of our session. Okay, move just a final question then. We've spoken a lot about the CCU as a unit but clearly that's made up of individual officers who are very professional in what they do. They may take quite a lot of the criticism out of this report. Personally, I mean I understood what Mr Finnie was referring to as a lads culture and I don't think it was meant as a slur on the people within that unit but that's clearly a perception that their peers and their colleagues have put across and some of their actions have been undermining morale within other officers. So can I ask did you get any indication of the morale of the current officers within the CCU unit? We've spoken with my first question today about the setup of the whole process and the fact that they've gone through quite a significant managerial change in the early days and also one of the points mentioned in your report was about a concern that they will be de-skilled. These are highly trained people who have specialities but doing a lot of the administrative work that you spoke about in response to the convener's question will raise concerns amongst them that they lose their skills. So can I just ask a general perception on the morale of the current members of the CCU? No, absolutely. As part of our field work myself and colleagues went round and spoke to probably the majority of staff within the CCU. Our view would be highly motivated individuals and strong integrity within that. I think they have a frustration around the image of the CCU within the organisation. I think that that image has been founded on legacy Strathclyde police carry forward into the early days of Police Scotland. I think a lot has been done within those people who are there now to try and move the organisation away from that. Things that were management meetings referred to in their report that were discredited. They have been changed and they are now in a more professional footing. So there is a lot of things that have been done. The staff that we spoke to in the main I suppose fell a little bit frustrated in that the skills that they have and what they expected to be doing within the CCU has not met their expectations and actually they are doing that low level work from there. And again that is a challenge I think for Police Scotland is the restructure and redesign their CCU is to make best use of the staff that they have and the skills that are there. Are you confident that the many recommendations in your review will be acted upon and they will transform the unit to be fit for purpose and to have the public and staff faith restored in it? How confident are you that all these valid points that you are making will actually make a difference to the unit? I am confident for two reasons. First of all there is a personal commitment from the chair of the authority. To make sure that those are taken forward and they are addressed. And there is an absolute personal commitment from the chief constable in this case. And as I said already they are looking to see how they can implement that. They are looking to develop structures. So not just to take this and put it on to a force action plan among many other recommendations that we have made. We are sensing there is a real commitment within Police Scotland and the leadership of Police Scotland to take this and actually focus on this and get it delivered in a way we will make the offer to work alongside. Although we scrutinise Police Scotland and we cannot be definitive around the solutions because of the work that we have put into this we will be keen to work alongside Police Scotland in developing their action plan to make sure that their action plan will meet the outcomes that we are looking for in terms of improvement. So I am confident that this is an area that has been identified and is taken seriously both by the chair of authority and the chief constable. Thank you. All right. If there are no further questions it only remains for me to thank Mr Penn and Mr Whitelock and Mr Young for attending today. And again, to say that we very much appreciate you bringing the report forward I think it's been a robust evidence session and the committee will decide what steps to take next in our future discussion of the work programme. Thank you very much for attending. I think we'll just move swiftly on to the next item which hopefully won't take long and item 5. The fourth item on the agenda is the consideration of two negative instruments the sexual offences act 2003 prescribed police station Scotland amendment regulations 2016 SSI 2016-187 and the air weapons licensing Scotland regulations 2016 SSI 2016-188. Do members have any comments on either of these SSIs? Yes. Just I think it will be useful to put on the record convener in relation to the delegated powers comments on the sexual offences etc regulations that they note the Government has said they will amend the order that's before us at the first opportunity it would be helpful if the Government indicated what first opportunity means in terms of a date because I always worry about those technical errors which is what we're talking about providing a loophole to some people who are potentially quite dangerous in our society and I think it would be helpful if the Government provided a date for first opportunity because I don't see any particular reason why there should be much delay. That's a very valid point and we will write to seek what exactly the first opportunity means. Are there any other comments? If not, yes, all of them. Into the second item to the air weapons licensing I'd just be slightly concerned that there's been no consultation on fees as part of this particularly given the relatively low number of air weapons that have been handed in as part of the amnesty versus the figure that was estimated at the time the legislation was brought forward and whether there should be any sort of consideration given to that. A couple of things it may be not for the SSI but something we can look at in the legislative consent motion that especially as the application seems to be the full price for the license seems to be going to be made at the point of application as opposed to when the license has actually been granted. But in terms of these SSIs if you're content just to write about the date and to look at the other issues with this legislation the LCM then are we content to make no recommendations? Content. Thank you. If I can move on to agenda item number five now on legislative consent my memorandum in respect of the Investigary Powers Bill have members any comments on this LCM? Stewart Stevenson I think this is a piece of Westminster legislation which in the round presents some considerable difficulties and we as a committee and indeed as a Scottish Parliament are not necessarily the place where all these should be dealt with but I think it might be appropriate for us to consider whether the minister might come along to give us his pitch on the effects of the Investigary Powers Bill on what is virus for the Scottish Parliament. Any other views? John Finnie I think this is a potentially significant piece of work and I certainly would go along with the recommendation that we consider a call for written evidence I think it's of that importance. Okay. As Stewart Stevenson said the bulk of it is reserved but there are aspects that will impinge on our work here on the devolved issues so if the members are content the clerks will issue a call for evidence from stakeholders in our consultation. Everyone agreed? Yes. Yes, I think that's all we need to do. That agenda item number six please crime bill legislative consent motion. This was added very much at the last minute but we thought it was good to get the LCM on the agenda today and then if we did want to take further evidence then we had the opportunity to do so. Any comments? I was being used by the phrase accidentally repealed convener and I hope there's no it was an important piece of legislation that was the letter of abatement so that's my only comment. Right. All the views are done on a targeted call for views. Right. Do we want a general or a targeted call for any more information on this? Which one did the firearms come back in? Was it this one? This one, yeah. Yeah, I wouldn't mind just calling for a little bit of more consultation than this given the fee aspect that I mentioned in the SSI that there's a departure from what is the standard process just now that I think the money is paid when the licence is granted and there has been a move without consultation now that on application of the full amount is payable whether it's granted or not so even from that aspect I think it would be quite good to get a call for some evidence in that if the committee is agreeable we'll take it that we are. Right. Thank you very much. And we now move into private session.