Licences and Ongoing Support for the Cellebrite ’Premium’ Tool

The Metropolitan Police Service (MPS) is seeking approval for a Call-Off from the CDW Heath Trust Europe Framework (H.T.E.) to Cellebrite for Licences and Ongoing Support for the Cellebrite ‘Premium’ Tool.

The Deputy Mayor for Policing and Crime is recommended to:

1. To approve the strategy and funding requirement to award a Call-Off from the CDW Heath Trust Europe Framework (H.T.E.) to Cellebrite for a period of three years for a total contract value of £2,090,000 at an average cost of £697,000 per annum, this award to comprise:

• A three year licence period commencing in July 2020 for 8 x Unlimited ‘Cellebrite Premium’ tools, this is when the current licences are due for renewal. These tools are to support the MPS’ three-tier forensic model and will be placed across x8 locations on the MPS estate.

• This will be funded from a combination of the additional police settlement grant available in 20/21 and existing revenue budgets.

• This is an increase in cost of £575,000 over the 3 year period. This additional cost will be managed from existing forensics budgets.

1. Introduction and background

1.1. There are currently no other suppliers who meet this requirement. Cellebrite ‘Premium’ is the only commercial tool that meets the MPS requirements.

2. Issues for consideration

2.1. The current MPS contract for the requirement expires on 31 August 2020.

2.2. The MPS has a licence for another tool that supports DCC’s forensic strategy This tool is compatible with IOS devices but is not compatible with Android based devices. Therefore, by having both licences the MPS is maintaining its current capability for IOS (as some devices will work on one tool but not the other) as well as Android devices which are being submitted in increasing volume.

2.3. It is also worthy of note that forensic practitioners will make a judgement for IOS submissions as to the best tool to use for an examination to obtain the best outcome. This will depend on the specific requirements of the Officer in the Case.

2.4. The existing capability provides unlimited IOS examinations. During the contract Cellebrite have also added capability to include a number of Android devices. This Android capability is increasing to a broader range of handset manufacturers. Going forward, to meet demand, the MPS require both an IOS and Android capability, otherwise this would limit effectiveness to support investigations.

2.5. This tool is restricted technology and gives the MPS an enhanced capability over and above what would normally be expected for an investigation. It is an enabler for the MPS under The Met Direction strategy in terms of seizing opportunities of digital and data tech.

3. Financial Comments

3.1. The total revenue cost for the three year contract term (excluding VAT and shipping) is £2,090,000 of which £660,000 is funded leaving a cost pressure of £575,000 in revenue. This covers support, software upgrades, hardware/software maintenance and training on the tool for authorised staff.

3.2. The additional revenue costs of £575,000 over 3 years will be managed through existing Forensic Services budgets.

4. Legal Comments

4.1. The Mayor’s Office for Policing and Crime (MOPAC) is a contracting authority as defined in the Public Contracts Regulations 2015 (the Regulations). The Regulations apply to awards of public contracts for goods and services where the value of the contract exceeds £189,330. This report confirms the value of the proposed contract is envisaged to be £2.09m over a three year term.

4.2. The Public Contract Regulation 32(2)(b)(iii) permits a contracting authority to negotiate directly with a sole economic operator without prior publication of an Official Journal of the European Union (OJEU} notice when, for reasons connected with the protection of exclusive rights, including intellectual property rights, the public contract may be awarded only to a particular economic operator. This confirms that the renewal of the licence is exempt from competition.

4.3. Paragraph 4.8 of the MOPAC Scheme of Delegation and Consent provides that the Deputy Mayor for Policing and Crime (DMPC) has delegated authority to approve business cases for revenue or capital expenditure of £500,000 or above.

4.4. Paragraph 4.13 of the MOPAC Scheme of Delegation and Consent provides that the Deputy Mayor for Policing and Crime (DMPC) has delegated authority to approve the procurement strategy for all revenue and capital contracts of a total value of £500,000 or above and to approve all contract exemptions for £100,000 or above.

4.5. Paragraph 4.15 of the MOPAC Scheme of Delegation and Consent provides that the Deputy Mayor for Policing and Crime (DMPC) has delegated authority to award MOPAC contracts with a total value of £500,000 or above.

5. Commercial Issues

5.1. The route to market is a Call-Off from the CDW Heath Trust Europe Framework (H.T.E.) direct with Cellebrite as they are the sole provider of the requirement.

6. GDPR and Data Privacy

6.1. The MPS is subject to the requirements and conditions placed on it as a 'State' body to comply with the European Convention of Human Rights and the Data Protection Act (DPA) 2018. Both legislative requirements place an obligation on the MPS to process personal data fairly and lawfully in order to safeguard the rights and freedoms of individuals.

6.2. Under Article 35 of the General Data Protection Regulation (GDPR) and Section 57 of the DPA 2018, Data Protection Impact Assessments (DPIA) become mandatory for organisations with technologies and processes that are likely to result in a high risk to the rights of the data subjects.

6.3. The Information Assurance and Information Rights units within MPS will be consulted at all stages to ensure the contract meets its compliance requirements.

6.4. The tool is already in existence, but will be subject to additional capability and as such DPIA and EIA will be completed in line with new requirements.

7. Equality Comments

7.1. The tool is currently in use and this is an extension to scope, where victims or families give approval and if it’s the suspect’s device, it fits under ‘policing purpose’. At this stage there are considered to be no negative equality or diversity implications arising from this procurement process however an Equality Impact Assessment is currently being assessed.

8. Background/supporting papers

8.1. Report.