Sun, 13 Jan 2008

Last few days for the consultation on Managing Protest around Parliament

The Home Office consultation on Managing Protest around Parliament closes on 2008-01-17. Have you sent your response in yet?

Peaceful demonstrations happened on Saturday. Here's what Rikki wrote at Indymedia about the London event:

in an afternoon of filming, at no time did i see a single act of violence towards the police from the peaceful protestors, and yet police used completely disproportionate and aggressive tactics to disperse and control peaceful sit-downs and blockades. i saw a 61 year old woman being dragged without any heed for 'health and safety' and dumped on the pavement. another elderly man was thrown over his bicycle (despite having recently had an accident leaving him in considerable pain)

there were several other arrests this afternoon, mainly for obstruction and public order offences. one person was arrested for 'organising an unauthorised protest'

See also Parliament Protest. And, don't delay sending in your response any further.

(In unrelated news, the planned demonstration by the Police Federation of England and Wales to go through Westminster on 2008-01-23 looks like it may be banned by the Metropolitan Police.)

websiteblogblog archivenews feedfeedback

What happens to the NDNAD backups?

Several readers of How to delete your DNA profile (El Reg) have queried what happens to the backups of the National DNA (and IDENT1) database. Here's Wayne Sheddan:

Do you know how the fingerprint and DNA records are removed from the backup tapes? These still contain the records from when they are first entered until they are removed? It's one thing to delete the records from the online database, it's another thing altogether to eliminate them completely from all data repositories...

Knowing most organizations it's likely the records are even online in the test systems - since these are often just a restore from production at some point in time, and are often 'refreshed' using production backup tapes...

Deleted - but not gone...

If only for cost reason it is unlikely for any backup tape to be expunged of ‘deleted’ data. Depending on the backup rotation scheme and the number of tapes used, the backed up data may have a finite lifetime and tapes degrade as they age and are eventually destroyed. Hence, it is likely that data such as fingerprints, DNA profiles and Police National Computer (PNC) records when ‘electronically deleted’ remain on backup tapes for possibly several more years. Deleted - but not (entirely) gone...

Another reader even suggested the possibility for the Police to keep a database of deleted DNA profiles. This is the standard operating procedure! ‘The Retention Guidelines are based on a format of restricting access to PNC data, rather than the deletion of that data.’ The step-down model effectively makes the data appear deleted to all but the Police and for Enhanced Checks. However, it is most unlikely the Police would maintain such a database of ‘electronically deleted’ records for ‘exceptional cases’ (as defined in these same Police guidelines) as it would be in complete contradiction to the statements they issue to each individual for whom they delete the DNA profile. Of course, if this procedure was to be changed in the future, all the records marked as stepped-down could be stepped back up.

Wayne Sheddan adds:

I just hope the legislation is such that records that have been deleted are subsequently inadmissible in court. I can just imagine the scenario where a restore is required, but the subsequent transaction roll-forward that contains the 'delete' commands fails - leaving the records in place again.... the legal status of the records must thus be the primary protection for the citizenry[residents].

Current legislation authorises the Police in England and Wales to keep the DNA profiles they collect – of innocents and convicted alike – forever. So if such records were used in court, even after the Police promised they had been deleted, they likely would be admissible as long as they were collected and retained legally. You could of course complain and/or go to trial about the fact that the Police lied to you but I'd expect that to be a separate matter entirely. (Reminder: I am not a lawyer and this is just my interpretation.)

This is yet another reason that makes the ‘exceptional case process map’, the SCD12 Senior Information Manager promised me will be published early this year so important. When describing all the steps taken when deleting electronic records (and destroying samples), the document will, hopefully, make it clear as well what happens to the backups of deleted data. Publishing this process will also mean that innocents getting their DNA profile deleted will be treated fairly as the process will be documented and the same for everyone in that situation.

P.S. Earlier this week, Professor Sir Alec Jeffreys, the geneticist who first found a way to identify people through their DNA two decades ago, told the BBC that ‘recent developments such as the retention of innocent people's DNA raises significant ethical and social issues.’

websiteblogblog archivenews feedfeedback

Mon, 07 Jan 2008

Police to create process for destruction of DNA samples and removal of DNA profiles

Last year I wondered: ‘Hopefully there are processes to ensure that no database record or bio-information sample is missed in the destruction and deletion procedure.’ Then I learnt that no such processes yet exist. El Reg published earlier today my article ‘How to delete your DNA profile’ that reveals that a process map is coming:

How to delete your DNA profile - A cut-out-and-keep reference guide

It's a little known fact that it's possible to have your DNA profile removed from the National DNA Database (NDNAD). While the Police have processes to gather and retain DNA samples - they don't yet have a procedure to delete the DNA of innocent members of the public.

It's complicated - but for now, this is what you should do.

Over four million profiles have been added to NDNAD since 1995. Last year, 115 profiles were deleted and 667,737 added. In the last five years, 634 DNA profiles have been removed from the database, while 2,649,937 profiles were added. In other words, the number of DNA profiles removed is around 0.02 per cent of the number of profiles added in the period - where we have the information.

According to a document called the Step model - Retention guidelines, it is considered "exceptional" for an innocent citizen to have one's DNA sample destroyed, and the associated DNA profile removed.

Currently, the destruction of DNA samples and removal of DNA records are "completed by way of an approved form being sent [by a Senior Information Manager from the Metropolitan Police Service Specialist Crime Directorate 12 (MPS SCD 12)] to designated staff in each of the departments concerned who are aware of the exceptional case procedure, once deletion / destruction has taken place we are informed and subsequently we notify the applicant, there is no process map in existence for this practice."

My own fingerprints and DNA were added to the database on 2005-07-28 when I was arrested on the London Tube.

Then ensued a complaint to the Independent Police Complaints Commission (IPCC), an investigation, an appeal to the outcome and a final decision by the IPCC. The final decision, dated 2007-05-03, "requested that the Metropolitan Police Service reconsider your request for your records and samples to be physically destroyed and electronically deleted, and for the summary information in the Police National Computer to be expunged."

The Misconduct Office informed me, on 21 August last year, that they had agreed to this request. Department SCD12 confirmed that my fingerprints were destroyed and the entry on the fingerprint database was deleted on 2007-07-24, my DNA samples destroyed and the entry on the DNA database deleted on 2007-08-20 and my Police National Computer (PNC) record deleted on 2007-08-30.

If you read the previous paragraph carefully, you may notice that the Misconduct Office requested the exceptional case to be dealt with by SCD12 before informing me of its decision, and SCD12 appears to have been prompt. So it was no longer possible for me to witness the destruction and removal actions. Hopefully there was no break in communications, and all those involved did their job properly without making any mistake. The information I received, unfortunately, leaves room for interpretation.

For instance, there was mention of "DNA sample" (singular) when two mouth swabs were taken - most likely a shortcut. Another example is that SCD12 asks "departments", but the labs that are contracted to analyse the DNA samples and keeping them are not part of the Police and hence not departments, most likely another shortcut.

So how would I know that my DNA profile really had been deleted? One way to verify this would be to plant some of my DNA at a crime scene and wait for a knock at the door. Obviously this is an experiment I will not undertake. I'd much prefer to have (verifiable) specific assurances rather than assumptions, but instead I'll have to trust the Police and the labs they use.

To avoid others having to go through this same situation, I shared these concerns with the SCD12 Senior Information Manager. The outcome: "An exceptional case process map will be available on the MPS Publication Scheme early 2008."

Having a documented process in place instead of the current ad-hoc mechanisms will go some way to increase confidence in the efficacy of what must be a complex procedure. Unsurprisingly, the Information Commissioner's Office has also been keen for a long time for the Police to implement such a step-out (deletion) procedure.

Publishing a process - which describes in detail the actions to be taken by the Police departments and their contractors - will help ensure other innocents get fair and open treatment in getting off the NDNAD. This, in turn, will help make exceptional cases the norm.

El Reg Read and comment on this article at El Reg...

websiteblogblog archivenews feedfeedback