Files on disk are not, in general, covered by the Investigatory Powers Act (note that this Act does apply to e-mail messages in mailboxes or queues). However the rights of users under the Human Rights Act must still be respected in any investigation.
Where an investigation may result in disciplinary or legal action, extreme care must be taken to preserve computer evidence as this is easily challenged.
The Association of Chief Police Officers' Good Practice Guide for Computer Based Electronic Evidence and the US Department of Justice guide to Electronic Crime Scene Investigation are both helpful. A guide to preparing for forensic investigations published by IAAC.
Note that those investigating misuse of computers may encounter information that is distressing or harmful to them, their colleagues or the organisation. Policies and procedures for investigation should be designed with this in mind, and should always be followed. For serious incidents, it may be worth engaging appropriate external investigators.
Possession of unlawful material
Where material is discovered that is unlawful to possess (such as in the case of indecent images of children, section 46 of the Sexual Offences Act 2003) investigators are provided with legitimate defence to the criminal offences of possessing or making such images. The Criminal Justice and Immigration Act 2008 covers other specific images illegal to possess, but also contains a similar defence.
As described in a Memorandum of Understanding between the Crown Prosecution Service (CPS) and the Association of Chief Police Officers (ACPO), these defences will be interpreted strictly so investigators must be sure that have clear authorisation, and that they document and report their actions to prove their legitimate purpose. Jisc has developed guidelines to help sites comply with the ACPO/CPS Memorandum of Understanding.
The Internet Watch Foundation have a helpful best practice guide to assist organisations in dealing with these types of material. (In Scotland, the relevant law is the Protection of Children and Prevention of Sexual Offences (Scotland) Act 2005, however it is understood that the same best practice would apply).
Investigating copyright complaints
Although the government’s proposed requirement on ‘ISPs’ to investigate copyright complaints has never been brought into force, Jisc customer organisations are still required to investigate such complaints under the Janet acceptable use policy. Our factsheet on investigating copyright complaints describes good practice for doing so.