Today, two people from Privacy International, one is Eva Blum Dumonté, she's a research

officer working on data exploitation, especially in the global south, and Millie Wood, who's a lawyer and is fighting against spy agencies, and before that, she fought seven years against police cases, and they're going to be talking about policing in the age of data

exploitation. Give them a warm welcome. As was just said, I've been at Privacy International for two years, working as a lawyer.

Before that, I spent seven years bringing cases against the police, and what increasingly concerns me, based on these experiences, is a lack of understanding of what tactics are being used by the police today, and what legal basis they're doing this on.

The lack of transparency undermines the ability of activists, lawyers, and technologists to challenge the police tactics, and whilst I'm sure a lot of you have a broad awareness of the technology that the police can use, I don't think this is enough, and we need to know what specific police forces are using against individuals.

The reason why is that when you're arrested, you need to know what disclosure to ask for in order to prove your innocence. Your lawyers need to know what expert evidence to ask for in order to defend their client,

and increasingly, as they're in visible ways, or seemingly visible, for the police to monitor a scale, we need to know that there are effective legal safeguards. Now those who are affected are not just the guilty, or those who understand technology. They include pensioners, such as John Catt, a 90-year-old man who's a peace protester,

and he's a law-abiding citizen, no criminal record, and yet he is on the UK Domestic Extremism database, and listed here are some of the entries.

He took his sketch pad and made drawings. He's clean-shaven, and he was holding a board with orange people on it. So this is the kind of people that they are surveilling. John's case exposes unlawful actions by the police, but these actions date back to 2005-2009.

As far as I'm aware, there are no cases challenging modern police tactics, and Privacy International in the UK, and with our partners throughout the world, are increasingly concerned at the pace this is developing, unobstructed, because people don't know what's going on.

And so, we've started in the UK to try and uncover some of the police tactics using Freedom of Information requests. These laws should be available throughout Europe, and we want to make similar requests in other countries, hopefully with some of you.

So now I'm going to hand over to my colleague Eva, who will talk a bit about Privacy International, some of the tactics we know the police are using, and then we'll speak about some of the things that we found out through our initial research. Thank you.

So I'm just going to tell you a little bit more about Privacy International for those of you who don't know this organization. We are based in London, and we fight against surveillance and defend the right to privacy across the world. Essentially, what we're doing is we do litigation, we conduct research, and we carry out advocacy, including at the United Nations.

We develop policies on issues that are defining modern rights. Now, our work ranges from litigations against intelligent services to a wide range of reports on issues such as connected cars, smart cities, and fintech. We've recently published investigations on the role of companies like Cambridge Analytica and Harris Media, and their role in the latest Kenyan elections.

With our network of partner organizations across the world, we advocate for stronger privacy protection in the law and technology, and stronger safeguards against surveillance. Now, we talk about data exploitation, and this is actually the title of the talk,

so what do we mean by that? The concept of data exploitation emerged from all concerns that the industry and governments are building a world that prioritizes the exploitation of all data. We observe three prevailing trends in data exploitation.

One is the access of data that's generated beyond our control. The second one is the fact that this data is processed in ways we cannot understand or influence, and the lack of transparency around it. The last one is that at the moment, this data is used to disadvantage us,

the ones who are producing this data, and it's further empowering the already powerful. We hardly control the data anymore that's generated for our phones and our computers, but now in the world we live in, data don't come just from our phones or computers. It comes from the cars we're driving, it comes from our payment systems,

from the cities we live in. This is all generating data, and this data is used by other entities to make assumptions about us, and take decisions that eventually influence our lives. Are we entitled to a loan? Do we qualify for affordable insurance?

Should we be sent to jail or set free? Who should be arrested? This is at the core of the world that we're building around data exploitation. The question of power imbalance between those who have the data and who get to make decisions based on this data,

and those who are producing the data and losing control over it. Now, what does policing have to do with data? Sorry, what does data exploitation have to do with policing? The police has always been actually using data in the past. To give you one example, in 1980, a transit police officer named Jack Maple

developed a project called Chart of the Future. This is how he described it. I call them the Chart of the Future. On 55 feet of wall space, I mapped every train station in New York City and every train.

Then I used Koreans to mark every violent crime, robbery, and grand larceny that occurred. I mapped the soul versus the unsolved. Now, the system was used by the transit police, and it was credited with reducing felonies by 27%, and robberies by a third between 1990 and 1992.

This generated a lot of interest in this project, and former New York mayor Rudolph Giuliani asked the New York Police Department to essentially take up Chart of the Future and develop their own project.

It became Comstart. Comstart was, again, essentially about mapping crime to try and make assumptions about where crime was happening. So this kind of shows this narrative, the building of this narrative,

around this idea that the more data you have, the more data you generate, the better you'll be at reducing crime. Now, it becomes interesting in the world we live in that we describe, where we are constantly generating data, often without the consent or even the knowledge of those who are producing this data.

So there are new questions to be asked. What data is the police entitled to access? What can they do with it? Are we all becoming suspect by default? One of the key elements of the intersection between data exploitation and policing is the question of smart cities.

It's worth bearing in mind that data-driven policing is often referred to as smart policing. So obviously the word smart has been used generally in a generic manner by various industries to describe this trend of using mass data collection in order to provide new services.

But there is actually a real engineering connection between smart cities and data-driven policing. The first reason for that is that actually one of the main reasons for cities

to invest in smart city infrastructure is actually the question of security. This is something we've explored in our latest report on smart cities, and this is emerging also from the work we're doing with other organizations, including Coding Rights in Brazil and DRF in Pakistan.

So actually Brazil is an interesting example because before the MIGA events, they started organizing the football workup and the Olympics. They invested massively in smart city infrastructure, including projects with IBM. Precisely the purpose of what they were trying to achieve with their smart city infrastructure

was making the city safer, so it was extremely strongly connected with the police. So this is a picture, for example, of the control room that was built to control CCTV cameras and to create graphs in order to showcase where crime was happening

and also the lackiness of natural disasters in some areas. In Pakistan, there's a whole new program on investment of smart cities, which is actually referred to as the Safe City Project. Now, companies understand that very well,

and this is actually an image from an IBM presentation describing their vision of smart cities. And as you see, policing is very much integrated into their vision, their heavily centralized vision of what smart cities are. So that's no wonder that companies that offer smart city infrastructure

are actually now also offering a platform for policing. So those companies include IBM, as I mentioned, but also Oracle and Microsoft. We see in many countries, including the UK, where we based some pressure on budgets and budget reduction for the police.

And so there is a very strong appeal with this narrative that you can purchase platform, you can gather more data that will help you do policing in less time and do it more efficiently. But little thought is given to the impact on society or right to privacy and what happens

if someone unexpected takes the reins of power. Now, we're going to briefly explain what data-driven policing looks like. And eventually Millie will look at our findings.

So the first thing I wanted to discuss is actually predictive policing because that's often something we think of and talk about when we think about data-driven policing. I mentioned CompStart before, and essentially predictive policing works on a similar premise. The idea is that if you map where crime happens,

you can eventually guess where the next crime will happen. So the key player in predictive policing is this company called Predpol. I think they describe pretty much what they do. They use artificial intelligence to help you prevent crime by predicting when and where crime will most likely occur.

Now, Predpol and other companies are using something called a hoax process that's used normally for the prediction of earthquake tremors. So what hoax originally did is that he was analyzing how after an earthquake,

you have aftershakes. And usually the aftershakes tend to happen where the original earthquake happened and in a short period of time after that. So the hoax process basically is described as when a certain event happens, other events of the same kind will happen

shortly after in the same location. Now obviously it actually works quite well for earthquakes. Whether it works for crime is a lot more questionable, but that's actually the premise on which companies that are offering predictive policing services are relying.

So basically applied to predictive policing, the mantra is monitoring data on places where crime is happening, you can identify geographic hotspots where crime will most likely happen again. Now, other companies than Predpol are joining in and they are adding more data

than just simply location of past crimes. So this data has included open source intelligence and we'll talk a little bit more about this later on, weather reports, census data, the location of key landmarks like bars, churches, schools, data sporting events, and moon faces. I'm not quite sure what they're doing with moon faces,

but somehow that's something they're using. When predictive policing first sort of emerged, one of the key concerns was whether our world was going to be turning into a minority reports kind of scenario where people are arrested before a crime is even committed.

And companies like Predpol were quick to reassure people and say that they're not concerned about who will commit crime but where crime is happening. Now, that's not actually true because in fact at the moment we see several programs emerging, especially in the US, where police departments are concerned not so much with where crime is happening

but who's committing it. So I'm going to talk about two examples of this. First one is the Kansas City No Violence Alliance, which is a program laid by the local police to identify who will become the next criminal, basically.

And they're using an algorithm that combines data from traditional policing as well as social media intelligence and information that they have on drug use. Based on this, they create graphics that are generated using predictive policing to show how certain people are connected to already convicted criminals

and gang members. Once they've identified those people, they request meeting with them, whether they've committed crimes or not in the past. And what they have a discussion about their connection to those convicted criminal and gang members, and what they tell them is that they are warned that

if a crime happened within their network of people, every person connected to this network will be arrested whether or not they were actually involved in the crime being committed. Now, there are actually dozens of police departments that are using similar programs.

The Chicago Police Department has an index of the 400 people most likely to be involved in violent crimes. That sounds like a BuzzFeed article, but actually there is a reality which is extremely concerning because those people who are in this list, or for the most part not actual criminals,

they are purely seen to be connected to people who've committed crime. So if your next door neighbor is a criminal, then you may well find your name on that list. Now, predictive policing is deceptive and problematic for several reasons.

First of all, there is the question of the presumption of innocence. In a world where even before you commit a crime, you can find your name on that list or be called by the police, what happens to this very basis of democracy, which is the presumption of innocence. But also there's the other question of like,

can we really use the math that was originally designed for earthquake and apply it to human beings? Because human beings don't work like earthquakes. They have their own set of biases. And the biases start with how we collect the data. For example, if the police is more likely to police areas

where there is a minority, people of color, then obviously the data they will have will be disproportionately higher on persons of color. Likewise, if they are unlikely to investigate white-collar crime, they will be unlikely to have data that are reflecting a reality

where crime also happens in wealthier areas. So basically we are imputing biased data sets that obviously will lead to biased results. And what these biased results mean is that it will continue the already existing trend

of over-policing communities of color and low-income communities. I'll leave it to Millie for the next thoughts. So one of the increasing popular technologies we're seeing in the UK, and there's no doubt views around the world and probably at border points,

although we need more help with research to prove this, is mobile phone extraction. The police can extract data from your phone, your laptop, and other devices, which results in a memory dump of the extracted data taken from your device and now held in an agency database. So, for example, all your photos, all your messages,

and all those of people who had no idea they would end up in a police database because they're associated with you, retained for as long as the police wish. Now, these devices are pretty user-friendly for the police, and if you're interested, you can look on YouTube,

where Celebrite, one of the big players, has lots of videos about how you can use them. And so depending on the device and the operating system, some of the data, this is from a police document, but it lists what they can extract using a Celebrite UFED, is what you might expect. Device information, calls, messages, emails,

social media, and Wi-Fi networks. But if you look at their websites, and here are a few examples, they can also collect system and deleted data, they can access cloud storage, and inaccessible partitions of the device. Now, this is data that is clearly beyond the average user's control.

And as the volume of data we hold on our phones increases, so will this list. And the companies we know the UK police are using, which includes Celebrite, Accesso, Radio Tactics, MSAB, all aware of how valuable this is.

And as one of them has stated, if you've got access to a person's SIM card, you've got access to the whole of a person's life. They also go on to note, the sheer amount of data stored on mobile phones is significantly greater today than ever before. There are also no temporal limits to the extraction of data.

This is from another piece document we obtained. And it shows that if you choose to extract a certain data type, you will obtain all data of a particular type, not just the data relevant to an investigation. So all that data on a police database indefinitely.

And even if you were asked whether you were happy for your data to be extracted during investigation, I think it's highly unlikely you would realize the volume that the police were going to take. Other targets for the police that we know about are

infotainment systems in cars, smart TVs and connected devices in the home. This is an extract from a TechUK report where Mark Stokes, head of digital forensics at the Met Police, which is the police in London, stated in January that the crime scene of tomorrow will be the internet of things,

and detectors of the future will carry a digital forensics toolkit that will help them analyze microchips and download data at the scene, rather than removing devices for testing. Now, I can imagine that the evidence storage room is going to get a bit full if they start dragging in

your connected fridges, hair dryers, hair brushes, your Google Home, Amazon Echo, and whatever else you have. However, their plans to walk into your home and download everything make no mention of needing a specific warrant.

And so the only limitations at the moment are the protections that may exist on the devices. The law does not protect us, and this needs to change. So, I'm going to be talking a little bit about open source intelligence and, in particular, social media intelligence.

Because when I talked about predictive policing, I identified those two sources as some of the data that's being used for predictive policing. Now, open source intelligence is often thought of as, or often assumed to be, innocuous.

And there is the understanding that if information is publicly available, then it should be fair for the police to use. Now, the problem is that among open source intelligence, there is often social media intelligence that we refer to as documents. Now, there are many ways to conduct a document,

and it can range from the single police officer who is just using Facebook or Twitter to look up the accounts of victims or suspected criminals. But there are also companies that are scrapping the likes of Facebook and Twitter to allow the police to monitor social media.

Now, social media has blurred the lines between public and private, because obviously we are broadcasting views on this platform. And at the moment, the police has been exploiting this kind of unique space, this blurred line.

They are accessing this content in a completely unregulated manner. As long as the content is publicly available, like, for example, you don't need to be friend or to have any already established connection with the suspected criminal or the police or the victim,

anything that's available to you is completely unregulated. There are no rules. And I mentioned earlier the question of budget restriction. And so the police is benefiting hugely from this because it doesn't really cost anything to use social media.

So at the moment, Sockmin is kind of like the first and easy step in a police investigation because there is no cost and because there is no oversight. Now, Sockmin actually isn't so innocent in the sense that it allows the police to identify the locations of people based on their posts.

It allows them to establish people's connection, their relationships, their association. It allows them only to ring off protests and also to identify the leaders of various movements and to measure the person's influence.

Now, in the UK, what we know is that the police is largely using marketing products. So this is an anonymous quote from a report by academics that have been doing research on Sockmin. And what someone said was that a lot of stuff came out of marketing because marketing were using social media

to understand what people were saying about their product. We wanted to understand what people were saying, so it's almost using it in reverse. Now, again, this is not considered like a surveillance device. This is purely a marketing project that they're using. And for that reason, law enforcement agencies

and security agencies often argue that Sockmin has basically no impact on privacy. But actually, when your post reveals your location or when the content of your post reveals what used to be considered and is still considered actually as sensitive private information,

like details about your sexual life, about your health, about your politics, can we really minimize the impact of the police accessing this information? Now, obviously we may not have a problem with the average Twitter user or with a friend reading this information, but when the ones who are reading the information

and taking actions on this information have power over us, like the police does, what does it actually mean for all rights to privacy? And that's not to say that people should stop using social media,

but rather, what kind of regulation can we put in place so that it's not so easy for the police to access? The absence of regulations on Sockmin has actually already led to abuse. In two cases, both in the U.S. that we've identified,

one is the rise of the city of New York, which is a case from the ACLU, where we knew that, we found out that the city of New York, sorry, the New York Police Department was systematically gathering intelligence on Muslim communities.

And one of the ways they were gathering this intelligence was essentially by surveilling social media accounts of Muslims in New York. The second case is a company called Zero Fox. So what Zero Fox does is social media monitoring. Now, during the riots that followed the funeral of Freddie Gray,

Freddie Gray was a man, a 25-year-old black man who had been shot by the police. So after his funeral, there had been a series of riots in the U.K. and Zero Fox produced a report that they shared with the Baltimore police, which essentially advertised for their social media monitoring tool.

And what the company was doing was, again, like browsing social media and trying to establish who were the threat actors in these riots. And among the 19 threat actors that they identified, two of them were actually leaders of the Black Lives Matter movement.

Actually, at least one of them was a woman, definitely not a physical threat, but this is how they were essentially labeled. So these two examples actually shows that, again, it's still the sort of same targets. It's people of color, it's activists,

it's people from poor-income backgrounds. They're singled out as likely criminals. And it's very telling when we realize that this document is actually one of the source of data that's eventually used for predictive policing. And then, again, predictive policing leading to people being more surveilled

and potentially exposed to more police surveillance based on the fact that they are all singled out as likely criminals. Now, social media is a fascinating place because it's a mix between a private and a public space. As I said, we are broadcasting our views publicly,

but then again, it's a privately owned space where we follow the rules that are set up by private companies. Now, if we want to protect this space and ensure that free expression and political organization can still happen on the spaces, we need to fully understand how much the police have been exploiting the spaces

and how we can limit and regulate the use of it. Now, I'll talk to Milly about what we can do next. So, I'm going to briefly look at some of our initial findings we've made using freedom of information requests. Broadly, the lack of awareness by the public, weak legal basis, and a lack of oversight.

Now, sometimes the lack of awareness appears intentional. We asked the police about their plans to extract data from connected devices in the home, and they replied, neither confirm nor deny. Now, this is kind of a bizarre response

given that Mark Stokes, who's a member of the police, had already said that they planned to do this. In addition, the UK Government Home Office replied to us, saying the Home Office plans to develop skills and capacity to exploit the Internet of Things as part of criminal investigations.

They also said that police officers will receive training in relation to extracting, obtaining, retrieving data from or generated by connected devices. So, we wrote back to every police force in the UK who had refused to reply to us, and presented the evidence, but they maintained their stance.

So, we will be bringing a challenge against them under the Freedom of Information Act. Now, Eva has also identified the huge risks associated with predictive policing. Yet, in the UK, we have found out this is set to increase, with forces either using commercial tools or in-house ones they've developed,

or planning trials for 2018. There has been no public consultation, there are no safeguards, and there is no oversight. So, when we asked them more questions about their plans, we were told we were vexatious, and they won't respond to more requests.

So, it seems like we have yet another challenge. And what about mobile phone extraction tools? Here are some of the stats that have been found out. And I would say these aren't completely accurate, because it depends on how reliable the police force are in responding. But, roughly, I'd say it's probably more than 93% now,

of UK police forces throughout the country are extracting data from digital devices. We know they plan to increase. We've seen in their documents they plan to train more officers, to buy more equipment, and to see extraction as a standard part of arrest, even if the devices had absolutely nothing to do with the offence.

And so, these figures are likely to increase exponentially. But in the UK, not only did the police not need a warrant, in documents we've read, they do not even need to notify the individual that they have extracted data, for example, from their mobile phone,

or that they're storing it. If this is being done without people's knowledge, how on earth can people challenge it? How can they ask for their data to be removed if they're found innocent? Turning to social media monitoring, which the police refer to as open source research,

this is Jenny Jones, she's a member of the House of Lords and the Green Party, and next to her photo is a quote from her entry on the domestic extremism database. And so, if a member of the House of Lords is being subject to social media monitoring for attending a bike ride,

then I think it's highly likely that a large number of people who legitimately exercise their right to protest are being subject to social media monitoring. Now, this hasn't gone unnoticed completely, although they're slightly old. These are quotes from two officials.

The first, the UK independent reviewer of terrorism, who notes that the extent of the use of social media monitoring is not publicly known. And the second is the chief surveillance commissioner, and this is a very strong statement for a commissioner, is saying that basically, social media should not be treated as fair game by the police.

So, now I'll move on to a weak or outdated legal basis. For most of the technologies we've looked at, it's very unclear what legal basis the police are using, even when we've asked them. This relates to mobile phone extraction, so the legislation they're relying on is over 30 years old

and is wholly inappropriate for mobile phone extraction. This law was developed to deal with standard traditional searches. The search of a phone can in no way be equated to the search of a person or the search of a house.

And despite the fact that we have repeatedly asked for a warrant, this is not the case. And we believe that there should be a warrant in place, not only in the UK, but in the rest of the world. So if you think that either you or your friends have had their data extracted when they're arrested, or your phone has been in the possession of the authorities,

you should be asking questions. And very briefly, something on lack of oversight. So, we reported in January this year about documents that were obtained by Bristol Cable's investigation into Celebrite. And one report said that in half of the cases sampled,

the police had failed to receive authorization internally for the use of extraction tools. Poor training undermined investigations into serious offenses such as murder, and inadequate security practices meant that encryption was not taking place even when it was easy to do,

and they were losing files containing intimate personal data. So why does this matter? Here are some key points. In relation to information asymmetry, it's clear, as Eva has explained, that the police can now access far more data on our devices than the average user.

In relation to imbalance of power, it's clear they can collect and analyze sources that are beyond our control, whether it's publicly placed sensors, cameras, and other devices. There is also unequal access, and if lawyers don't know what's been gathered, they don't know what to ask for from the police.

All in all, this puts the individual at a huge disadvantage. Another impact is the chilling effect on political expression. Now, I'm sure many of you maybe think that the police monitor your social media, but the average person is unlikely to.

And so if they start to know about this, are they going to think twice about joining in protesting either physically or using a hashtag? And what about who your friends are? If they know you attend protests, are they really wanting to have their data on your phone if they know that potentially that could be extracted and end up on a police database?

It's far easier to be anonymous face among many people than a single isolated person standing up to power. But these new forms of policing we have been discussing redefine the very act of protesting by singling out each and every one of us from the crowd.

So, what can we do? Many of you will be familiar with these technologies, but do you know how to find out what the police are doing? In the UK, we've been using freedom of information requests. We want to do this with people throughout Europe, and you don't need to be a lawyer, so please get in touch.

We also want to dig into the technology a bit more. I want someone to use a Cellebrite UFED on my phone and show me exactly what can come out of it. And we want to tell lawyers and activists about these new techniques. Many lawyers I speak to who are experts in actions against the police do not know the police are using these tools.

This means they don't know the right questions to ask. And so it's fundamental you speak to people who are bringing these cases and tell them about what they can do or what questions they should be asking. And finally, we want you to also raise the debate to share our research and to critique it.

Thank you. So we've got ample of time for Q&A.

Are there any questions in the hall? Yes, there's one over there. You mentioned the problem of when they do physical extraction from a Cellebrite device, it's going to get all of the photos or all of the emails or whatever it may be, rather than just what the investigator needs. What is the solution to that from your eyes?

Is it a technical one that these companies are going to have to implement which they're not going to or a legal one because on the other side a mobile phone is a crucial part in any criminal investigation in 2017. So what's the workaround or the solution to that? I think it's both. I think the fact that there isn't any law looking at this

and no one's discussing can there be a technical solution or does it need to be one where there's better regulation or oversight so you extract everything. Can you keep it for a certain period to see what's relevant? Then do you have to delete it? The trouble is we don't see any deletion practices and the police have publicly stated in the media

that they can just keep everything as long as they like. They like data. You can kind of see why but that doesn't mean they should keep everyone's data indefinitely just in case it's useful. So I think there may be tech solutions, there may be legal ones and I think perhaps both together is one of the answers. The next question from microphone one please.

I'm just wondering how those laws and regulation and power given to the cops are being sold to the UK people. Is it because to fight terrorism they said or to fight drugs or this kind of stuff? What's the argument used by the government to sell that to the people?

I think actually one thing that's important to bear in mind is that I'm not sure most of the public in the UK are very invasive and aware of it. So I think unlike the work of intelligence services and agency where terrorism is used as the excuse for ever more power and especially laws

that have become increasingly invasive, actually with policing we don't even fall in that kind of discourse because it's actually hardly talked about in the UK. The mobile phone extraction stuff we've been looking at is low level crimes. So that's like, it could be a pub fight, it could be a robbery, which that's more serious,

it could be an assault. So they want to use it in every case. For all the other techniques we have no idea what they're using for. That's one of the problems. The next question from the internet please. When you say that there's a lack of laws and regulations for police concerning your essence,

document and data from devices, are you talking just about UK and or USA or do you have any examples of other countries who do better or worse? I don't know of any country that has regulation on publicly available information on social media. Microphone number four.

Thank you again for a great talk. In terms of data exploitation, an element that I didn't hear you talk about that I'd like to hear a little bit more is that there are questions around who is doing the exploitation. I know in the US some FOIA researchers get around how difficult it is to get data

from the feds by going after local and state police departments. Is that something that you're doing or do you have a way of addressing confusion when people don't know what agency has the data? Yeah, I think actually one of the things the data exploitation program at First International is doing is actually looking into the connection between the private sector and governments

and obviously at the moment there's the whole question of data brokers which is an industry that's hardly regulated at all that people don't necessarily know about. The companies that are doing it are in familiar household name. Let's merely talk a lot more about the government aspects of it.

I guess the question is again a country by country basis. We work in many countries that don't have any data protection regulations at all. So there is this first difficulty how do we regulate, how do we limit the power of the state when you don't even have the basic legislation

around data protection. One thing to bear in mind is the problem with companies is how do you also hold companies accountable whereas with the states there is the whole challenge of finding the right legal framework to limit their power. Maybe I'll let Amelia talk a little bit more about this.

Yeah, with our FOIA requests we tend to go after everyone. So with the example of the Home Office saying something that the other police didn't that was because we went to all the different state bodies. And I think there's a good example in the states where there's far more research done on what the police are doing but they're using the same product in the UK, I think it's Axiom

and they're a storage device for body worn camera videos. And a lawyer in the states said that in order to access the video containing his client he had to agree to the terms and condition of using Axiom's website which basically gave them full use of his client's video about a crime scene. So that's a private company having use of this video.

So given that we found they're using it in the UK we don't know if those kind of terms and conditions exist but it's a very real problem as they rely increasingly on private companies. And number two please. Thank you for your work. Perhaps you've already answered this partially from other people's questions

but it looks like we have a great way to start the process and kind of taking the power back but the state and the system certainly doesn't want to give up this much power. How do we actually directly, what's kind of the end game? What's the strategies for making the police or the governments give up and restore balance?

Is it a suit? Is it challenging through parliament and the slow process of democracy? Or what do you think is the right way of doing it? I never think one works on its own. Even though I'm a litigator I often think litigation is quite a weak tactic particularly if you don't have the public on side and then again if you don't have parliament.

So we need all of them and they can all come through different means. So we wouldn't just focus on one although different countries it might be better that you go down the legal route or down the parliamentary route but in the UK we're trying all different routes. So for example on mobile phone extraction in the beginning of next year we're going to be doing a video,

we're going to be doing interviewing the public and speaking to them about it, we're going to be going to parliament and I've also been speaking to a lot of lawyers so I'm hoping some cases will start because those individual cases brought by local lawyers are where also you see a lot of change like the John Catt case, that's one lawyer. So I think we need all different things

to see what works and what sticks. We haven't had number three yet. Hi, thanks for the talk. So I have a question concerning the solution side of things because one aspect I was missing in your talk

was the economics of the game actually because you are from the UK and the private sector has stepped in also in another public domain, the NHS to help out because funds are missing and I would like to ask you whether or not you think first of all the logic is the same

within the police departments because it might also be a cost-driven aspect to limit the salaries because you have a problem with police force coming in because you have to pay their rents and automated things

especially when given to the private sector which has another whole logic of thinking about this stuff which is cost-saving and so maybe it would be a nice thing if you could talk a bit about

the attempt to maybe get economics a bit more into the picture when it comes to solutions of the whole thing? I think you are very right in pointing actually to compare what is happening with the NHS

and what is happening with the police because the economics of companies offering policing services arise from the same situation there is a need of doing more efficient policing because of budget cuts so the same way the NHS is being essentially privatised

due to the budget cuts and due to the needs that arise from being limited in your finance again there is a similar thing with the police when you are understaffed then you are more likely to rely on technologies

to help you do your work more efficiently because essentially with predictive policing the idea behind it is that if you know where and when crime will happen then you can focus the limited resources you have there and not look at the more global larger picture

I'm not going to be here on stage advocating for more funds from the police I'm not going to do that but I think there is a desperate need to reframe the narrative around how we do policing and definitely also look at a different perspective and a different approach to policing

because as I've tried to show you, it's been a really long time since this narrative has developed of more data leads to crime resolution but actually what I didn't have the time to get into in this talk is actually all the research that I'm showing that those products actually don't work like Predpol is actually basically gaslighting

a lot of police officers with their figures the kind of figures that they are pushing and suggesting are just plain inaccurate it's not accurate to compare a city on one year to what a city is becoming in another year so it's not even clear that a lot of this project are even properly functioning

and in a sense I don't want them to function I'm not going to say if we had better predictive policing then the problem will be solved no, that's not the question the question is how do we have regulation that force the police to look differently into the way they are conducting policing

and number four please so thank you for your presentation I have a question about SOGMINT for my opinion SOGMINT might violate the terms of services of for example Twitter and Facebook have you tried to cooperate with these companies to make them actually enforce their TOS?

So actually there are companies that are doing scraping of data and you're right in this case they violate the terms of services of Facebook and Twitter now the problem is that there is already a loop to this

and actually the marketing company I was talking about that's being used by the UK police what they essentially do is that they purchase the data from Facebook and Twitter and this is why it's interesting because when Facebook says we don't sell your data well essentially actually with marketing tools

that are there to monitor what people say about products essentially what they're doing is selling your data they're not selling your name or your location or things like that but whatever you're going to be posting publicly for example in groups or public pages is something that they're going to be trying to sell to those companies

so I think you're right and maybe Mille will have more to say about this I think those companies have a role to play but at the moment I think the challenge we face is actually this loop that we're facing where by purchasing the data directly from the company

they don't violate the terms of services We've spoken a bit to some of the social media companies and we've been told that one of their big focuses is the problems of the social media monitoring at the US border and so because there's a lot known about that they're looking at those issues

so I think once we show more and more the problems say in the UK or in other countries I think it would be very interesting to look at what's happened over the Catalan independence vote period to see how social media was used then I think the companies aren't going to react until we make them although they probably will meet with us

a slightly different aspect that we revealed in a different part of our work that the intelligence agencies were gathering social media that's probably not groundbreaking news but it was there in plain fact so they all got a bit concerned about how that was happening

whether some of them knew or some of them didn't so the better our research the more people speaking about it I think they will engage or we'll find out are the police getting it lawfully or unlawfully And number one please Thanks for your talk I have a question on predictive policing

because German authorities in the last two years piloted pre-corps, pre-pol projects in three states and they claimed that they would never use these techniques with data on individuals but only aggregate data like the new repeat stuff you presented and they presented as just an additional tool in their toolbox

and that if used responsibly can lead to more cost-effective policing Do you buy this argument or would you say that there's inevitably a slippery slope or kind of like a path dependency to more granular data assessment or evaluation that would inevitably infringe on privacy rights?

I think, and this goes back to the question of like are we using policing to identify where crime is happening or who is committing a crime but actually I think even if we stick to this even if we stick to identifying where crime is happening we still run into problems

we still run into the fundamental problem of predictive policing which is we only have data on crime that have already been reported that have already been addressed by the police and that's by essence already biased data if we have a police in some areas then we are more likely to further police

because the solution of those companies of those algorithms will be leading to more suggestions that crime is happening more predominantly in those areas so as we've seen so far is that we fall into these fundamental problems

of over-policing communities that are already over-policed so in a sense in terms of the right to privacy but also the question of the presumption of innocence I think purely just trying to cultivate data on where crime is happening

it's not efficient policing first of all but it's also causing challenges for fundamental rights as well. I guess not a great comparison but a lot of what they are bringing in now is a programme to assist you with a charging decision

so you've got someone you've arrested do you charge them or not? The police say of course it's only advisory you only have to look at how busy a police station is to know how advisory is that going to be and how much is it going to sway your opinion so the more you use these tools the more it makes your job easier because rather than thinking where are we going to go

what areas are things going to happen who are we going to arrest well the computer told us to do this so let's just do that. Thank you. And microphone number three please. Thank you. Do you think that there are any credible arguments to be made for limiting the police's abilities under acts in the UK

that incorporate EU level restrictions on privacy, data protection human rights or fundamental rights and if so do you anticipate that those arguments might change after Brexit? Well they're bringing in GDPR and the law enforcement directive now and they're not going to scrap those once Brexit comes in

we'll still be part hopefully of the European Court of Human Rights but not the European Court of Justice. I think there are going to be implications it's going to be very interesting how they play it out they're still going to want the data from Europol they want to be part of Interpol policing operates at a different level and I think if they have to comply with certain laws

so that they can play with the big boys then they probably will but they may do things behind the scenes so it depends where it works for them but certainly the politicians and definitely the police want to be part of those groups so we'll have to see but we will still use them and we'll still rely on European judgments

the force they have in a court of law may be more difficult. Does the internet have any questions? Nope. Wow. And then number two please. So you've mentioned that they don't have really good operational security and sometimes some stuff that shouldn't have leaked

now within the last year we had major data leaks all across the world like Philippines, South Africa, just to mention a few now if the data security is so bad in the police in Great Britain it's not unlikely that something will happen in Europe of a similar kind

what kind of impact do you think such a huge data leak of private information which the police legally stored has even if it was not leaked by the police and it would be leaked by a private company that had some way access to it? I guess it depends what it is

a database with serious criminals and only the bad people then people will think well it's good they have that information but they need to make it more secure if somehow databases which held all sorts of information say from people's mobile phones, innocent people's pictures all that kind of thing then we might see a much wider public reaction

to the tools that are used and the safeguards the legal safeguards will become a lot quicker than probably we will achieve in the way we're trying to go now because there will be a bigger public outrage Ok, one last and hopefully short question from Microphone1

Hi, thanks for the talk, it was really interesting it's actually quite a short question how much does it celebrate and can we buy one? I did look to buy one I think there was some on eBay but I'm not sure if they were the right things

but a couple of thousand pounds but I think you have to actually be a police force to get those ones maybe there are other types but it's expensive but not unobtainable but I'm trying to find universities that might have them because I think a lot of forensic schools I'm hoping that they will I know they do extractions of laptops but I haven't found one yet that does phones

but I probably haven't asked enough people Thank you very much