Non-confidential facts and advice to the Deputy Mayor for Policing and Crime (DMPC)
1. Introduction and background
1.1. Demand modelling has shown an increase in demand for Open Source (OS) intelligence services. Online crime continues to grow dramatically. Phishing, trolling, malware and online scams are increasingly reported to the MPS. More than 90% of reported crime now has a digital element. Often this involves the police investigator retrieving evidence from digital devices and this includes social media, mobile phone applications and the Internet.
1.2. The aim of this licence purchase is to improve the effectiveness of the service provided by trained OS users, in order for the MPS to develop enhanced intelligence and identify tasking opportunities to tackle and prevent violent crime; and safeguard more vulnerable people. The new system supports agile working and bringing OS capability to the front line of policing.
2. Issues for consideration
2.1. This business case requests approval to upgrade OS Intelligence to update security for the Internet platform where officers conduct their online research and investigation.
2.2. New software also supports smarter working and improves functionality for users. The project proposal is for OS software to be installed on all MPS computers, supporting agile working. New data capture tools ensures the police investigators are able to interrogate all aspects of data now used Online.
2.3. This supports audit and inspection, ensuring officers are compliant with legislation, including compliance with Home Office revised Code of Practice August 2018 (Covert Surveillance and Property Interference). A central audit function and audit logs helps identify examples where repeated viewing of an individual or group is taking place, which requires Directed Authority, supporting compliance with Regulation of Investigatory Powers Act 2000 (RIPA).
3. Financial Comments
3.1. The capital cost of £287,650 is fully funded from the approved Capital Plan.
3.2. The project revenue cost of £390,402 will be met from the Project Revenue budget in Digital Policing.
3.3. The ongoing revenue cost of £170,728 p.a. for the initial allocation of 800 licences will be funded from the Digital Policing revenue budget. This additional cost is offset by savings of £87,788 in Year 2 and £116,958 from Years 3, giving a net additional cost from Year 3 of £53,770 p.a.
3.4. If the additional 250 licences are required they will be funded from existing MPS budgets and this will take the total ongoing cost up to £194,656 p.a. After taking the savings into account, the additional cost from Year 3 is £77,698 p.a.
4. Legal Comments
4.1. MPS Directorate of Legal Services (DLS) have been consulted as part of the assurance process.
4.2. Under Paragraph 4.13 of the MOPAC Scheme of Delegation and Consent provides that Deputy Mayor for Policing and Crime has authority to approve all requests to go out to tender for contracts of £500,000 or above, or where there is a particular public interest.
4.3. The Mayor’s Office for Policing and Crime (MOPAC) is a contracting authority as defined in the Public Contracts Regulations 2015 (the Regulations). The Regulations apply to awards of all public contracts for goods and services (save for specific service categories listed in Schedule 3 of the Regulations, which are not applicable here) where the value of the contract exceeds £181,302 for goods and services (as from 1 January 2018).
4.4. This report confirms the value of the Call-Off via the G-Cloud 10 Framework Agreement is envisaged to be £548,520 over a maximum four year term. Accordingly, the Regulations have been applied. Regulation 33(5) provides that Framework Agreements may be open for use by other contracting authorities where they have been clearly identified for that purpose in the call for competition. Regulation 33(7) provides that where a Framework Agreement is concluded with a single economic operator (as is the intention with G-Cloud 10) Call-Off contracts shall be awarded within the limits in the Framework Agreement. The report confirms Regulation 33 was followed.
4.5. Key stakeholders, including DLS will be engaged throughout the project and prior to the implementation of any change.
5. Commercial Issues
5.1. The MPS approach would be to award a Call-Off Contract, procure the licences and mobile devices for up to a period of 24 months, with the option to extend for up to two further individual periods of 12 months each.
5.2. The Call-Off Contract would be awarded via the Crown Commercial Services Framework Agreement (Digital Marketplace, through G-Cloud 10 Framework Agreement (Digital Market Place) Lot 1 (Cloud Hosting Software and Support) awarding to the single supplier identified. The Framework Agreement was set up between the Government and suppliers and permits public sector organisations to utilise.
5.3. Only one available G-Cloud 10 contract on the framework matched the statement of requirements and could deliver on the key requirements. The system is currently utilised by a number of other UK police forces and therefore gives assurances to the MPS that this is a tried and tested product within the police environment. The contract operates on a Call-Off basis and prices have been agreed based on MPS estimated licence volumes and is underpinned and protected by the Crown Commercial Service’s terms and conditions. The Framework Agreement also saves the MPS the additional time and internal resource that it would take to conduct an OJEU tender for the same requirement.
5.4. The Framework Agreement provides the MPS with a recognised compliant route to market and is the only G-Cloud option available that fully meets the MPS requirements. The Framework Agreement permits Call-Offs to be awarded for up to a maximum period of 48 months.
5.5. It has been confirmed that the supplier ensures payment for employees in accordance with legislation governing the current Living Wage. The supplier is compliant with the Responsible Procurement Code of conduct, which includes Supplier Diversity and Ethical Procurement. The supplier has in place an Environment Policy, a Health and Safety Policy and robust on line Security Policies.
6. GDPR and Data Privacy
6.1. A DPIA has been completed for this project. The project will ensure a privacy by design approach, which will allow the MPS to find and fix problems at the early stages of any project, ensuring compliance with GDPR. DPIAs support the accountability principle, as they will ensure the MPS complies with the requirements of GDPR and they demonstrate that appropriate measures have been taken to ensure compliance.
6.2. A key feature of the new proposals includes the ability to audit user activity. This supports policing compliance in respect of Human Rights and activities carried out under Regulation of Investigatory Powers Act 2000 (RIPA). Audit logs are also used in Professional Standards and Counter Corruption units across UK Police Forces to support investigation and compliance with legislation.
6.3. The MPS is subject to the requirements and conditions placed on it as a 'State' body to comply with the European Convention of Human Rights and the Data Protection Act (DPA) 2018. Both legislative requirements place an obligation on the MPS to process personal data fairly and lawfully in order to safeguard the rights and freedoms of individuals.
6.4. Under Article 35 of the General Data Protection Regulation (GDPR) and Section 57 of the DPA 2018, Data Protection Impact Assessments (DPIA) become mandatory for organisations with technologies and processes that are likely to result in a high risk to the rights of the data subjects.
6.5. DPIAs are part of a privacy by design approach. It will allow the MPS to find and fix problems at the early stages of any project, which might otherwise accompany a breach of data protection laws and regulations.
6.6. DPIAs also support the accountability principle, as they will ensure the MPS complies with the requirements of GDPR and demonstrate that appropriate measures have been taken to ensure compliance
7. Equality Comments
7.1. An Equality Impact Assessment (EIA) has been completed. Already operating in other Police Forces, this new system has been assessed for both positive and negative impacts on protected characteristics. Internally the system has been confirmed as compatible with Assistive Technology, supporting disability.
7.2. This EIA will be regularly reviewed and support and guidance from the Strategy Diversity and Inclusion team will be maintained throughout the lifecycle of this project.
8. Background/supporting papers