Spying on you using fake social media profiles: One Scots council could

Updated A Scottish council has published a new policy paper which justifies its "investigating officers" creating fake accounts for snooping purposes on social media, though it denies ever having conducted such covert surveillance.

Bordering the city of Edinburgh, East Lothian Council has published a nine-page Surveillance through Social Media Policy (PDF), explaining how it would conduct online covert surveillance if it wanted to.

Using Facebook as an example, the council's policy document explained that its investigative officers would utilise social media for surveillance by using "a covert identity using a false name" and "entering into a personal relationship with the third party/group member."

According to the Edinburgh Evening News, however, the council has insisted it would "never create fake profiles" but merely included the measure in the policy because it believed it was legally bound to do so. Yes, really. Councils north of Hadrian's Wall are bound by the Regulation of Investigatory Powers (Scotland) Act 2000 (RIPSA) when engaging in surveillance activities, and because it is bound by RIPSA, it had to let it, er, RIPSA...

A spokesperson said: "East Lothian Council has never used covert identities for social media as part as an investigation, and is highly unlikely to do so, a policy must be put in place to include all eventualities even if they are not used."

It is not clear in what circumstances a covert identity would be necessary to access the information contained in a private group on Facebook. RIPSA legislation already allows for a wide number of authorities to seek the info directly from Facebook.

Update

A spokeswoman from East Lothian Council told The Register:

In his annual report 2013/14, the Surveillance Commissioner states under 5.3.3, “I strongly advise all public authorities empowered to use RIPA to have in place a corporate policy on the use of social media in investigations.”

Most Scottish councils have policies for surveillance through social media already in place and, like East Lothian Council, have no intention of ever using these powers. The policy received cross-party support as all councillors accepted that having such a policy would protect staff and was simply the council acting responsibly.

The powers under RIP(S)A can only be used for three purposes: for the prevention and detection of crime or disorder, for public health or for public safety.

Moreover, the law has very high thresholds for necessity and proportionality embedded into the possible use of these powers. For public authorities, this means that surveillance would only ever be authorised if a sufficient explanation has been provided as to why it is necessary to use the covert techniques instead of anything overt.

Proportionality in this connection means that surveillance must only ever be used a last resort. The three elements of proportionality that will always be considered are:

1. Balancing the size and scope of the operation against the gravity and extent of the perceived mischief

2. Explaining how and why the methods to be adopted will cause the least possible intrusion on people and protect their privacy under the Human Rights Act

3. That the activity is an appropriate use of the legislation and the only reasonable way, having considered all others, of obtaining the necessary result

In effect these thresholds mean that it is extremely unlikely that East Lothian Council officers will be conducting any covert investigation into service users through social media. Creating false identities would undergo even more rigorous testing and will definitely not ever be used by East Lothian Council – it is a provision aimed at the police. As it is part of the law, however, it had to be included in the policy.

®