03/2017: Julia invests in the Digital Forensics team, making sure the police can investigate technology in all its forms’

Executive Summary and Recommendation:

• What issue(s)/opportunities you are addressing/providing 

Due to the increasing and diversifying demand for Digital Forensic service provision which has resulted in the expansion of Digital Forensic capability through the ‘Vulnerability paper’, service delivery upon current model in an expanded DFU will become less efficient. The Digital Forensics Unit (DFU) is seeking to implement an effective, scalable, future proof model for service delivery which will introduce efficiencies and operational benefits incorporated into the Alverton Court relocation. 

• What impact there would be on NYP’s ability to deliver a policing service 

The proposed virtualisation based server solution would significantly enhance North Yorkshire Police’s Digital Forensic service provision, to support victims of child sexual exploitation and other offences which include digital evidence. The proposed solution also enhances the opportunities for collaborative work with regional neighbouring Police forces and reduces risks relating to the current delivery model. 

Recommendations

• To support procurement and implementation of a managed service, server based (virtualisation) model for the Digital Forensics Unit as part of the relocation of services from Newby Wiske to Alverton Court.
• To approve capital expenditure of an additional £580,000 to facilitate provision of a Digital Forensics service at Alverton Court within national mandated timescales for accreditation.
• The nature of the service provision will be reviewed during 2017/18 in the light of developing options for a collaborative regional digital forensics service.

Decision

Police and Crime Commissioner decision: Approved

Signature: 
Date: 16 February 2017
Title: Police and Crime Commissioner

 Introduction and Background

Current Structure:

The Digital Forensics Unit (DFU) currently works on a server based network linking a series of high specification desk top computers which are capable of processing multiple cases simultaneously. This configuration is a suitable solution for a small unit however, following the recent commitment to invest in the DFU (the expansion of DFU being previously approved as part of the investment into vulnerability), the DFU are set to increase their size significantly; as such the current approach to service provision could introduce inefficiencies within a larger DFU. The following issues have been identified:

• The expansion of the Unit in its current form will introduce significantly higher power requirements for the unit, which introduce additional cabling requirements for Alverton Court and therefore additional ongoing costs and greater environmental impact.
• The expansion of the current system would require a significant rolling capital and revenue investment programme relating to computer hardware and storage media.
• The requirement for the DFU to obtain accreditation to ISO17025 standards, whilst incorporating the Forensic Science Regulator’s Codes of Practice and Conduct, would result in additional operational resource abstraction to manage and maintain the existing infrastructure.
• The current solution limits the capacity for shared or multiple user access to individual case files, therefore DFU resource has limited capability to perform simultaneous work on any single case.
• The opportunity to ‘remotely access’ the DFU environment is extremely limited in its current form, restricting the support available to operational work eg early evidence for interviews and charging.
• Collaborative activity would be difficult to achieve, again as externally accessing DFU network is extremely limited.

As a long term model for delivery, the current system has inherent inefficiencies and fails to maximise the potential for improved service delivery to the communities of North Yorkshire made available through developing technology.

Initial Consultation/Outline Options:

At present the seven forces in the NE region have differing approaches around how they deliver their DFU services. Under current constructs it is highly likely that the each force would need to retain a local footprint (in order to host officers who will be examining images in relation to victim identification and also provision scene data capture capability) to service local victims of crime. However it is apparent that opportunities exist to develop a collaborative approach and seek, in the future, to share workloads either through bespoke specialisms being corralled into a centre of excellence; Accreditation being centrally owned and managed or through remote access to investigations across forces.

As there is an existing collaboration for traditional forensics already established within the Yorkshire and Humber region, research into how other YatH forces deliver their Digital Forensic Services has been undertaken by ICT and DFU personnel. From this work an outline ‘options paper’ was prepared and presented to the project sponsor and a preferred option was initially approved for development into this decision notice.  This preferred option requires the creation of a server based solution incorporating virtualisation technology to be implemented at Alverton Court, which has been extrapolated from the Humberside and South Yorkshire design they jointly procured in 2014. In simple terms it reflects the broader ambition of NYP core ICT network to introduce a virtualisation server network with access through thin client.

Peer meetings between NYP and Humberside have been undertaken and were very positive, with Humberside providing the tender pack and the winning bidder’s response upon which the costings for the option have been calculated.  To mirror this solution NYP would be required to create the technical specification requirements and questions to publish the Crown Commercial Services Tender. As NYP utilities collaborative procurement services through SYP this should be of benefit to reduce the time and cost of publication.

The Forensic regulator has set specific timescales for the accreditation of Digital Forensic Services with accreditation being achieved across all functions by October 2017.

Preferred Option Benefit/Risks:

The preferred option requires the creation of a server based solution incorporating virtualisation technology to be implemented at Alverton Court:

Benefits

• Reduction of Server Room power requirement from 30.3kW to only 9kW.
• Mitigation of DFU requiring uplift in overall power cabling and bespoke air cooling within the work environment with associated cost implication and reduction of environmental impacts.
• Operation support and Business continuity benefits deriving from this solution as it can be deployed centrally at Alverton Court and allow Digital Forensic Investigation roles to work from any NYP building.
• The solution is centrally configurable, resulting in ability to standardise the operating environment to optimise usage, improve efficiency and benefit accreditation requirements.
• Digital evidence processing time will be reduced to release more investigator time to service caseload, reduce outsourcing and provision of a better service to victims
• It will enable multiple investigators to work upon a single case concurrently
• It has (in comparison to the existing model) low ongoing capital and revenue running costs
• It aligns with the solution adopted by SYP and Humberside potentially facilitating joint working in a collaborative way
• It is scalable, reducing resource/management overheads relating to growth
• Provides a high level of resilience and support for service provision, significantly reducing risks relating to expansion of current system

Risks

• It relies upon external suppliers bidding through the tender process for the work and being able to dovetail with HQ17 and ICT availability to achieve a solution that is viable and accredited by the time the existing HQ closes. ICT resources would have to be made available.
• There would be a requirement for contingency planning as there is no fall-back position to move the existing model to Alverton Court as this would require additional investment in air cooling, power cabling and power maintenance that would be redundant when the virtual solution is implemented.

n.b  these risks are inter-related and planning is ongoing to schedule activity to collectively mitigate the risks.

Other Options Considered

Contribution to Police and Crime Plan Priorities

Whilst securing, preserving and producing digital evidence in relation to all forms of criminality, the Digital Forensics Unit has the greatest impact on, and prioritises efforts in relation to, offences linked to paedophilia. This includes the production, collection and distribution of indecent images of children and the grooming and coercion of children to engage in sexual activity. As technology has developed, new digital offences such as sextortion and online harassment have become common place.

In all cases the offender seeks to identify and exploit the vulnerable for their own gain. This exploitation often leads to long term, sometimes irreversible damage to the victim’s physical and mental health.

Digital forensic investigations have become increasingly focussed on victim identification and safeguarding. Before victim care can begin the victim must first be identified. An efficient and effective approach leads to ever earlier intervention. Intervention reduces repeat victimisation and improves the prospect of recovery.

The move to an integrated virtualised server based solution for digital forensics, will lead to significant improvements in both efficiency and effectiveness. The managed solution will result in far more investigator time spent conducting investigations rather than servicing and maintaining the raft of hardware currently used. Central configuration will standardise the operating environment and provide an infrastructure that is more stable and sustainable. The server solution will enable Investigators to have access to evidence much earlier in the investigation, from anywhere in the force, resulting in improved outcomes through the interview and charging process. The server solution is scalable (users can be added and removed without the need to procure additional hardware), providing future proofing and is aligned to the solution adopted by near neighbours, facilitating potential joint or collaborative working.

Implementation and Resourcing Implications

The Forensic Science Regulator has set specific timescales for the accreditation of Digital Forensic Services which coincide with the timescales associated with the Alverton Court move. Accreditation is to be achieved within Digital Forensic service provision by October 2017. North Yorkshire will be seeking accreditation based upon our current processes and set-up and transitioning to the proposed delivery method following completion of the move.

Implementation plan outline

ICT have produced an implementation plan outline which operates within the time constraints relating to the DFU landscape. This plan incorporates all aspects of this project and would require a resourcing investment from DFU, Procurement (regional) and ICT (Project Management and technical staff) and may have a consequential impact upon other existing ICT projects. This would, however, remove the requirement for delivery of ICT Project 2014-079 as the proposed virtualisation would include the functions required for this project.

Consultations Carried Out

The below table should include who has been consulted and their feedback.  Not all departments will need to be consulted with on every proposal, however, they should all be considered:  

Compliance Checks

Chief Constable Chief Finance Officer Comments:

The additional capital cost of £580k is mitigated to some extent by the identified revenue savings, although the power cost implications at Alverton Court have not yet been fully identified.  This money is not currently in the MTFP, and if approved will mean that funding for other projects in the future may have to incur borrowing costs, which will increase the costs of those projects.

The revenue saving could be transferred by RCCO on an annual basis to help fund the upfront capital costs. 

PCC Chief Finance Officer Comments:

The investment in the Vulnerability area of the organisation, aligned with the move from Newby Wiske has provided, and necessitated, the need to review the way that the Digital Forensic Unit function is delivered within the Force, to ensure it is fit for purpose in the short term and scalable to meet future requirements. The investment outlined within this Decision Note, whilst significant and not included within the current MTFP, will be factored into future plans if approved. By approving this Decision Note it will not necessitate borrowing any funds currently and therefore there will be no risk in breaching borrowing limits. Of the 5 options that have been looked at, and are referred to in section 2, the proposed option was costed to be least expensive and is the preferred option of the subject matter experts working in this area and therefore provides the best option for approval by the PCC

Legal Implications: 

Having read this report and having considered such information as has been provided at the time of being asked to express this view, the Monitoring Officer is satisfied that this report does not ask the PCC for North Yorkshire to make a decision which would (or would be likely to) give rise to a contravention of the law.

Human Resources Implications:

Having read this report and considered the information provided including the recommendation to the Police and Crime Commissioner, there are no people related impacts which will occur if we implement this new technology, people related issues will be considered and addressed as part of the related  move to Alverton Court and will have been covered in that decision notice.

Public Access to information

As a general principle, the Commissioner expects to be able to publish all decisions taken and all matters taken into account when reaching the decision.  This Notice will detail all information which the Commissioner will disclose into the public domain.  The decision and information will be made available on the Commissioner’s website.

Only where material is properly classified as Restricted under the Government Protective Marking Scheme or if that material falls within the description at 2(2) of The Elected Local Policing Bodies (Specified Information) Order 2011 will the Commissioner not disclose decisions and/or information provided to enable that decision to be made.  In these instances, Part 2 will be used to detail those matters considered to be restricted.  Information in Part 2 will not be published.

All decisions taken by the Commissioner will be subject to the Freedom of Information Act 2000 (FOIA).

Part two

Is there a Part 2 to this Notice – YES

If Yes, what is the reason for restriction –

The Chief Constable is of the opinion that the information included in part 2 falls under Section 2(2) of The Elected Local Policing Bodies (Specified Information) Order 2011, i.e. it

(a)          would be against the interests of national security;
(b)          might jeopardise the safety of any person;
(c)          might prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the administration of justice; or
(d)          is prohibited by or under any enactment.

or
The information included in Part 2 is properly classified as Restricted.

Report information

Date created: 04/11/2016

I confirm that all the above advice has been sought and received against this and any associated Part 2 information and I am satisfied that this is an appropriate request to be submitted for a decision

Signature: Adrian Gathercole

Date: 04/11/2016