Crime and Corruption Commission v Acting Deputy Commissioner Wright & Anor [2021] QCAT 18

QUEENSLAND CIVIL AND ADMINISTRATIVE TRIBUNAL CITATION: Crime and Corruption Commission v Acting Deputy Commissioner Wright & Anor [2021] QCAT 18 PARTIES: CRIME AND CORRUPTION COMMISSION (applicant) v ACTING DEPUTY COMMISSIONER D A (TONY) WRIGHT BKP (respondents) APPLICATION NO/S: OCR344-19 MATTER TYPE: Occupational regulation matters DELIVERED ON: 22 January 2021 HEARING DATE: 21 October 2020 HEARD AT: Brisbane DECISION OF: Member Kanowski ORDERS: The disciplinary substantiation decision made by Acting Deputy Commissioner Wright on 23 August 2019 is confirmed. CATCHWORDS: POLICE – INTERNAL ADMINISTRATION – DISCIPLINE AND DISMISSAL FOR MISCONDUCT – QUEENSLAND – where confidential databases accessed – whether accessed by the subject officer – whether accessed for an official purpose Police Service Administration Act 1990 (Qld), s 1.4 Briginshaw v Briginshaw (1938) 60 CLR 336 Rejfek v McElroy (1965) 112 CLR 517 APPEARANCES & REPRESENTATION: Applicant: Z Valeska, Principal Lawyer, Crime and Corruption Commission First Respondent: M Vassilakos, Acting Senior Legal Officer, and M L Girvan, Legal Officer, Queensland Police Service Second Respondent B I McMillan instructed by Gilshenan & Luton Legal Practice -- 1 of 18 -- 2 REASONS FOR DECISION Introduction This proceeding concerns a constable (referred to here as BKP) in the Queensland Police Service. He was subject to a disciplinary proceeding conducted by Acting Deputy Commissioner Wright. This stemmed from BKP’s interactions with a woman (referred to here as NFT) in 2016 and 2017 when he was stationed in a regional town (referred to here as town A). In short, it is undisputed that BKP had sex with NFT while on duty after giving her and another person a lift in a police vehicle. On a later date, he failed to conduct a random breath test on NFT. BKP also allowed fellow officers to operate his QLITE device, which is an iPad used to access confidential databases used by police in their work. These databases include the police database QPRIME and the Queensland Transport database. The Acting Deputy Commissioner found that the above conduct amounted to misconduct, and that the appropriate disciplinary sanction included a demotion and a transfer. The Acting Deputy Commissioner concluded that two other disciplinary allegations were not substantiated. These involved accessing confidential information on the databases without an official purpose, and persistently making unwanted contact with NFT in the months after their sexual encounter. The Crime and Corruption Commission has sought a review in relation to both substantiation and sanction. The Commission contends that the allegation that BKP accessed confidential information without an official purpose is able to be, and should be, substantiated. The Commission does not, however, seek a review of the Acting Deputy Commissioner’s decision relating to the alleged persistent unwanted contact. The present decision deals with the question of substantiation of the allegation relating to accessing confidential information. The question of sanction will be dealt with subsequently. Legal framework ‘Misconduct’ is defined in section 1.4 of the Police Service Administration Act 1990 (Qld) as conduct that: (a) is disgraceful, improper or unbecoming an officer; or (b) shows unfitness to be or continue as an officer; or (c) does not meet the standard of conduct the community reasonably expects of a police officer. The tribunal has jurisdiction to conduct a review of a disciplinary decision.1 A review is by way of a rehearing, generally on the original evidence, but the tribunal may also give leave for new evidence in certain circumstances.2 The purpose of a review is to produce the correct and preferable decision.3 1 Crime and Corruption Act 2001 (Qld), s 219G(1). 2 Ibid, s 219H. 3 Queensland Civil and Administrative Tribunal Act 2009 (Qld), s 20(1). -- 2 of 18 -- 3 A finding of misconduct is one with serious consequences. It is therefore relevant to bear in mind the comments of Dixon J in Briginshaw v Briginshaw: … when the law requires the proof of any fact, the tribunal must feel an actual persuasion of its occurrence or existence before it can be found. It cannot be found as a result of a mere mechanical comparison of probabilities independently of any belief in its reality. No doubt an opinion that a state of facts exists may be held according to indefinite gradations of certainty; and this has led to attempts to define exactly the certainty required by the law for various purposes. Fortunately, however, at common law no third standard of persuasion was definitely developed. Except upon criminal issues to be proved by the prosecution, it is enough that the affirmative of an allegation is made out to the reasonable satisfaction of the tribunal. But reasonable satisfaction is not a state of mind that is attained or established independently of the nature and consequence of the fact or facts to be proved. The seriousness of an allegation made, the inherent unlikelihood of an occurrence of a given description, or the gravity of the consequences flowing from a particular finding are considerations which must affect the answer to the question whether the issue has been proved to the reasonable satisfaction of the tribunal. In such matters “reasonable satisfaction” should not be produced by inexact proofs, indefinite testimony, or indirect inferences. Everyone must feel that, when, for instance, the issue is on which of two dates an admitted occurrence took place, a satisfactory conclusion may be reached on materials of a kind that would not satisfy any sound and prudent judgment if the question was whether some act had been done involving grave moral delinquency.4 Nonetheless, the point made by Dixon J that the criminal standard – proof beyond reasonable doubt – does not apply in a civil matter was reiterated by the High Court in Rejfek v McElroy: The difference between the criminal standard of proof and the civil standard of proof is no mere matter of words; it is a matter of critical substance. No matter how grave the fact which is to be found in a civil case, the mind has only to be reasonably satisfied and has not with respect to any matter in issue in such a proceeding to attain that degree of certainty which is indispensable to the support of a conviction upon a criminal charge … 5 Evidence and written submissions The evidence before the tribunal consists of: (a) the original evidence and the disciplinary correspondence (exhibit 1) compiled under Tab A (pages 1 to 90) and Tab B (pages 1 to 1106), together with audio recordings of interviews; and (b) the affidavit of Inspector David Jackman, discussing the security measures for QLITE devices (exhibit 2) – allowed as new evidence in the proceeding. Written submissions were also provided in advance of the oral hearing by the Commission (dated 3 April 2020), by BKP (dated 27 April 2020) and by the Commission in reply (dated 14 May 2020). 4 (1938) 60 CLR 336, 361-362. 5 (1965) 112 CLR 517, 521-522. -- 3 of 18 -- 4 Background A single ‘matter’ of misconduct was alleged against BKP, but it was broken down into seven particularised allegations: matters 1(a) to 1(g). The present review involves a review in relation to matter 1(d), concerning database accesses. However, it is relevant for context to set out the other disciplinary allegations and to discuss some of the surrounding circumstances. NFT lived in town A. She told investigators she met BKP in around October 2016 when she was working at a bottle shop. Just before Christmas 2016, she started working at a hotel. She had separated from a man, referred to here as Y, who is the father of her children. It is undisputed that the sexual encounter between NFT and BKP occurred at the end of 2016, around Christmas or new year. Within some months after this, NFT formed a new relationship, with a man referred to here as Z. A disciplinary notice issued by the Acting Deputy Commissioner described ‘matter 1’ as being that between 1 November 2016 and 19 December 2017 BKP’s conduct was improper, both on and off duty, in that he engaged in conduct as follows (in summary), referred to as matters 1(a) to 1(g): (a) in performing his official duties, he used a Queensland Police Service vehicle to transport members of the public for a purpose not authorised by the Queensland Police Service – this related to giving a lift to NFT and her companion, shortly before NFT and BKP had sex; (b) he engaged in sexual intercourse with NFT while on duty; (c) he persistently made unwanted contact with NFT while on and off duty; (d) he accessed confidential information contained within the Queensland Police Service computer system without an official purpose related to the performance of his duties as a member of the Queensland Police Service; (e) he failed to adequately secure his service firearm and accoutrements while on duty – this related to BKP removing his trousers including his utility belt containing his firearm and ammunition, before having sex with NFT; (f) he failed to conduct a random breath test on NFT on 18 March 2017; and (g) he provided access to his QLITE device to other town A police officers without authorisation. The Acting Deputy Commissioner found that matters 1(a), (b), (e), (f) and (g) were substantiated: they had occurred and they constituted misconduct. These allegations were not disputed by BKP before the Acting Deputy Commissioner, and his decision on them is not challenged in the present proceeding. In relation to matter 1(c), relating to persistent unwanted contact, NFT had described BKP calling her, sending texts, driving slowly past her house, on a few occasions stopping in at her house, and intercepting her and her new partner Z when they were driving. She described the most recent visit to her house as having been in about late September 2017. NFT provided investigators with text message exchanges between herself and BKP. These showed ongoing interest by BKP in meeting: for example on 19 April 2017, 16 May 2017 and 17 June 2017 he asked whether she wanted to catch up. On 25 June 2017 at 10.44 pm he asked whether she wanted him to come around for a chat. NFT did not reply. -- 4 of 18 -- 5 In his directed discipline interview on 19 December 2017, BKP acknowledged that he had continued to contact NFT. For example, he described an occasion when he dropped in to NFT’s house during the day to say hello when her children were there. He thought this was in about August 2017. The Acting Deputy Commissioner found that matter 1(c) was ‘not capable of being substantiated’.6 He accepted that there was ongoing contact by BKP but he also found that NFT had not told him to stop contacting her. Nonetheless, there is clear evidence of ongoing personal interest by BKP in NFT into 2017 when most of the database accesses occurred. As the Commission submits, this is a matter to be borne in mind in assessing whether it is likely that BKP made the database accesses and if so, whether the purpose was operational or personal. On matter 1(d), relating to accesses to databases, the Acting Deputy Commissioner found that the matter was ‘not capable of being substantiated’.7 Accesses on five dates were particularised in the disciplinary notice: 28 November 2016, 7 February 2017, 24 June 2017, 22 July 2017 and 25 August 2017. They involved searches or ‘checks’ on NFT or persons or vehicles associated with her. It is undisputed that they were made on the QLITE device that had been issued to BKP. The accesses are shown in activity reports – printouts of accesses – for BKP. As will be discussed, accessing a database through a QLITE device is a two-step process. First, one has to unlock the device using a passcode for the device or by using a biometric means. Second, one has to enter a payroll number and the password for that payroll number to open up a database. Officers are required not to share devices, passcodes or passwords. In theory, then, it should have been an open and shut case as to who had performed the accesses. A complicating factor, however, was evidence before the Acting Deputy Commissioner that it was common practice at the town A station for QLITE devices to be shared between officers; that several officers knew BKP’s passcode; and that it was possible for a user to access databases left open on devices that had been logged into by another user. The Acting Deputy Commissioner said that he suspected that BKP had performed one or more of the accesses. However, he said that he could not be satisfied to the required standard that they had actually been performed by BKP, or that they were not for an operational purpose. The Commission seeks review of the decision about matter 1(d), contending that the Acting Deputy Commissioner’s finding was ‘wrong and against the weight of the evidence’.8 The Commission submits that, with the possible exception of the accesses on 24 June 2017, the tribunal should find that the accesses were performed by BKP and for other than operational purposes. The technology and the security measures The evidence about the technology and the security measures is a little confusing because different people sometimes use different terms for the same thing, and 6 Exhibit 1, Tab A, 36. 7 Ibid. 8 The Commission’s written submissions dated 3 April 2020, [1(a)]. -- 5 of 18 -- 6 sometimes the same term is used for different things. However, the following is sufficiently clear, and I find: (a) a QLITE device is issued to a particular officer; (b) the device is unlocked using a passcode or a biometric login such as a fingerprint; (c) passcodes expire after 90 days, and the officer will be prompted to create a new one; (d) the screen of a device will lock after 60 seconds of inactivity; (e) to access a database on a device, an officer’s payroll number and password must be entered; (f) once a database is open, it will remain available for 12 hours unless closed, and so it can be accessed during that period (including after a screen has locked and then been unlocked) without once again having to enter a payroll number and password; (g) any officer using the device could access databases using that officer’s own payroll number and password, and any searches then done would show up on an activity report for that officer; (h) in an operational procedures manual, it is stipulated that officers are to keep operational equipment in their possession or under their control, and in a locked receptacle when the equipment is not in use; (i) when a QLITE device is issued, Mobile Capability Command requires the officer who is issued with the device to complete a user acceptance agreement acknowledging that the device is for the exclusive use of the officer and that the device and passcode must not be shared; and (j) BKP had failed to complete and return his user acceptance agreement. When summarising the evidence of witnesses, I will use terms such as passcode and password in the way I have used them above, even though some of the witness have used different expressions. The significance of the evidence above in the present case is that if another officer knew the passcode for BKP’s QLITE device, or had biometric access, and they unlocked the device or had it handed to them unlocked, they would be able to access a database which had been opened by BKP within the last 12 hours and left open. Any searches of the database done by the officer would show up on BKP’s activity report. The activity reports often reveal very rapid progression from one search to the next: from a vehicle to an associated person, for example. I infer that in the databases a searcher can immediately link from a record about a person or vehicle to another record about an associated person or vehicle. There are various mentions in the evidence of flags displayed in the records. From the context, it appears that these are alerts on matters such as whether a member of the public is wanted for something or whether particular caution should be exercised in approaching the person. -- 6 of 18 -- 7 What access to information is permitted? The material before the tribunal does not contain any guidelines about the purposes for which databases may be accessed. During the hearing, the Commission sought to introduce evidence of a direction to officers that may have afforded some clarification, but I declined to allow such new evidence for reasons given orally at the hearing. Nonetheless, the investigation and the review have proceeded on the basis that access to information on databases such as QPRIME would be proper only if done for an operational purpose. I accept that this basis is correct. Access in order to obtain information that might help an officer pursue a romantic interest, for example, would be improper and would constitute misconduct. Shared use of QLITE devices In his directed interview, BKP said, in summary: (a) it was common practice at the time in town A for QLITE devices to be shared; (b) this was because they were very useful tools, and only a few were available at the time; (c) officers would leave them in the day room for others to use; (d) he would do this sometimes; (e) he had given other officers his passcode but not his password; (f) there were occasions when he forgot to log out of the databases, and this would have meant that someone on the next shift could access the databases; and (g) if he was driving on a patrol, on occasions he would allow his colleague in the vehicle to unlock his device and access databases for operational purposes. The disciplinary investigator checked with other officers at the station and confirmed that at the time in question, it was indeed common practice for QLITE devices to be shared. Sharing was done by way of officers leaving devices for others to use on the next shift, or between officers on patrol together in a vehicle. The practice stopped as a result of the investigation into BKP’s conduct. The following is a summary of what the officers told the investigator. Sergeant A9 said that although he had never used a QLITE device himself, it was a practice for staff who were assigned a QLITE device to leave it at the station for others to use. Senior Constable B10 said he had never used a QLITE device himself, but officers who had them would leave them for others to use on other shifts, and would provide their passcodes to enable this. Senior Constable C described the practices of sharing devices from one shift to the next, and between colleagues in a vehicle. She had used BKP’s device. She was provided with the passcode, not the password, but added that ‘…as QLITE devices 9 Exhibit 1, Tab B, 1097. 10 Exhibit 1, Tab B, 1102. -- 7 of 18 -- 8 were handed over, they were at times already logged in on QLITE so checks may have been conducted under another [officer’s] login’.11 When using BKP’s device, to the best of her knowledge she would have logged on to databases with her own payroll number and password, but ‘there may have been instances where his device was handed to me already logged in on QLITE in another [officer’s] name and I utilised it’.12 Constable D13 described the practice of officers sharing devices. She had used BKP’s device, but only on occasions when he was present. On some occasions he unlocked the device using his thumbprint, while on other occasions, such as if he was driving, he told her his passcode. However, she would then use her own payroll number and password to access databases. She had not conducted any searches relating to NFT on BKP’s device. There is also evidence that this officer at some point gained her own device. Constable E14 said it was accepted practice to use other officers’ devices with their permission. He had used BKP’s device and had been provided with the passcode. He would have used his own payroll number and password to access any databases as he did not know BKP’s password. He could not recall conducting any searches relating to NFT, whom he did not know, but he said it was possible that he had while conducting a vehicle check. Constable F also described the practice of devices being left for officers on the next shift to use. Only the passcodes were given out, and all officers always logged on to databases using their own payroll numbers and passwords. He had used and borrowed BKP’s device, and had the passcode as well as fingerprint access. BKP ‘would often offer me his QLITE for my shifts’.15 He conducted many vehicle and licence checks while using BKP’s device, but to the best of his knowledge always used his own payroll number and password. He did not know BKP’s password. He does not know NFT and does not recall if he carried out any checks relating to her while using BKP’s device. Constable G described device-sharing as ‘standard practice … due to a limited number of devices’.16 He had used BKP’s device with his permission, and had been provided with the passcode by BKP. To access databases, he would have logged in using his own payroll number and password. Constable H17 described an occasion when she was on patrol with BKP and he was driving the police vehicle. She used his device to conduct database searches, but she believes she used her own payroll number and password. However, as will be discussed in relation to accesses on 24 June 2017, other evidence strongly suggests that this belief by Constable H was mistaken. 11 Exhibit 1, Tab B, 1089. 12 Exhibit 1, Tab B, 1090. 13 Exhibit 1, Tab B, 1079. 14 Exhibit 1, Tab B, 43. 15 Exhibit 1, Tab B, 1092. 16 Exhibit 1, Tab B, 32. 17 Exhibit 1, Tab B, 1081. -- 8 of 18 -- 9 Constable J also described the practice of sharing devices. He would have used BKP’s device on occasions when on patrol when BKP was driving. BKP told him the passcode, and Constable J could also use his fingerprint to unlock the device. He used his own payroll number and password to access databases when using colleagues’ devices, but several times he realised part way through a shift that he had ‘forgotten to log out the previous user of the QLITE’.18 (I take this to mean that he had inadvertently accessed databases using the previous user’s logon). He would rectify this immediately. Constable J said this could have happened when he was using BKP’s device. He was unsure if he had used BKP’s device to conduct searches relating to NFT, as he had used the device to conduct checks on many people and vehicles. Constable K19 said the practice had been for whoever had a device to leave it at the station for others to use on their shifts. He could not remember if he had used BKP’s device, but if he had it would have been while they were on a shift together. He could not recall if he was told the passcode. He could not recall carrying out checks relating to NFT on BKP’s device, but if he had it would have been done using his own payroll number and password because he was never given another officer’s password. Having regard to all of this evidence, I find that it was a widespread practice at the relevant time in town A for officers, including BKP, to share their QLITE devices. I find that this sharing occurred both by leaving the devices at the station after a shift for others to use, and between officers in a vehicle on patrol. While many of the officers in their answers to the investigator insisted that any accesses would have been done using their own payroll number and password, that insistence must be treated with caution. The information from these officers was provided some time after the event, when recollections would have dimmed somewhat. Further, it was provided in a disciplinary investigation, when the officers would have become well aware of the stern view being taken of sharing. This may have caused them to recall their own practices in a somewhat favourable light. The information was largely provided by way of email, and the officers’ evidence has not been tested by cross-examination. Some officers said in effect that they could not have accessed databases in another officer’s name because passwords were not shared. They may have overlooked, been unmindful of, or forgotten that an already-open database could be accessed. Other officers spoke with less certainty, conceding that they or others had or may have inadvertently used another officer’s logon to access databases. Further, some of the sharing occurred on patrol. Urgency or ease in that situation would increase the likelihood of an officer using an already-open database rather than going through the tedious process of logging off and entering their own payroll number and password. It is not possible to make precise findings as to how often officers accessed databases left open by other officers, but it is inherently unlikely that it was rare. BKP’s general comments on accesses relating to NFT and her associates In his directed interview, BKP maintained that any database accesses he performed relating to NFT, her former partner Y, or her new partner Z, would have been for operational purposes. He suggested various reasons why he might properly have performed accesses: such as in the course of random breath testing; seeing a vehicle 18 Exhibit 1, Tab B, 1084. 19 Exhibit 1, Tab B, 1106. -- 9 of 18 -- 10 go by and checking it and perhaps seeing and then following up a flag; or to find details about someone whom he knew to be an associate of NFT but whose name he could not remember. BKP also mentioned intercepting Z for making a loud sound with his car. He said that he may on that occasion have made checks or his colleague might have done so without him being aware of it. Accesses on Monday 28 November 2016 The database accesses in question occurred at various times between 8.18 and 9.14 am. Police records indicate that BKP was on traffic patrol at the time with Constable D. The accesses began with a car registered to Y. The accesses progressed to Y and NFT, who was an ‘associated person’ of Y, and a car registered in NFT’s name. The records that were accessed contained various types of information including about licence disqualifications, past incidents and charges, and so on. There was a significant gap between 8.23 am and 8.57 am. It appears that this must have been a period of inactivity, because the last search at 8.23 am was simply for a ‘mugshot’. There was another gap between 9.01 am and 9.08 am, and another between 9.09 am and 9.14 am. There were some other people whose records were viewed in the course of the accesses, including a male referred to here as N and a female, but it is not very clear whether these people had any association with NFT. It seems that one of the names was an alias for NFT.20 N was described by the interviewer in the directed interview as having an ‘other intimate personal relationship’21 with NFT. If that is accurate, presumably there was a link from NFT’s record to N’s. There were also accesses relating to a heavy trailer. In the directed interview, the interviewer said that was unrelated to NFT. There were also accesses in relation to another car and person where there is no suggested connection with NFT.22 NFT told investigators that at the time Y was in the habit of driving their children to school in the morning. She said she would have walked to work in the morning. Constable D told investigators that she barely remembered the day in question but she accepted from the records that she and BKP were on traffic patrol at the relevant time. She did not recall any particular vehicles or database accesses. She could not recall which of them was driving. She said she knows NFT and she had no recollection of her being pulled over on the day in question. She said that Y’s name sounded familiar but she did not know if she had met him. She could not say whether a vehicle of the type and colour of Y’s was pulled over that day, but she thought she would remember if it had been because there were not too many such vehicles in town A. In his directed interview, BKP said he could not recall if he or Constable D was using his device on this occasion. He said his practice at the start of his shifts had been to ‘log into my name’23 (which I take to mean that he would open up the databases on his device). He said he could not recall searching in relation to Y’s vehicle but if he was following a car he would usually search up the driver. (Presumably he meant the person to whom the car is registered). He said he may also have checked the databases for any associates, who might turn out to be in the car. He said he may not have known NFT’s full name at the time but he might have searched about her because she was 20 Exhibit 1, Tab B, 125. 21 Exhibit 1, Tab B, 1035. 22 Exhibit 1, Tab B, 891-900. 23 Exhibit 1, Tab B, 1037. -- 10 of 18 -- 11 unlicensed for a period and he thinks she may therefore have been flagged on the database. Asked why there would have been a search for the vehicle registered to Y at 9.08 am, following the one at 8.18 am, BKP said that he and his colleague might have seen the vehicle a second time. Asked why there would have been a second search in relation to one of the other names, BKP said it might have happened from him accidentally hitting a button while the device was on his lap. Asked why he would have looked at photographs of associates, BKP began ‘Just curi-’,24 before changing tack and suggesting that he would have looked for faces, especially of anyone who was flagged. He said that sometimes faces are more recognisable than names. He said he would check images to see if he knew or recognised people. The Commission submits: A QPRIME search was conducted on [Y] …, with checks conducted on [NFT], her antecedents, vehicle, and other associates at 08:18 hours. The amount of time spent on this search is logged as 40 minutes.25 BKP or his lawyers calculated the relevant search time at seven minutes and 32 seconds. I have not done my own calculations, but clearly the lower figure is, at least, much more accurate. The Commission also submits, in relation to the accesses overall (not just on this date), that BKP seeks to explain them as operational or having been performed by others. However, the Commission submits, the better explanation is that BKP performed them, because: (a) they were performed on his device and under his logon; (b) each search was connected to NFT; (c) BKP had had sex with NFT in late 2016; (d) he perceived her to be a friend when explaining his ongoing contact with her; (e) the searches looked at ‘intimate partners’, which is a matter that would have interested BKP in light of his association with her; and (f) the likelihood of a multitude of different officers all searching for NFT for reasons they cannot identify is less than BKP searching for a person with whom he had had a sexual encounter and in whom he remained interested. There is force in this argument, though it is diminished by the evidence of how widespread the practice of sharing devices was, and how easily one officer could inadvertently and unconsciously use another’s access. Further, ‘multitude’ is an overstatement, given that there were only five dates of access over a period of nine months, and BKP’s account is that some of the accesses were either performed by him or in his presence. It is also relevant to bear in mind that searches commenced with (or on the last day comprised) vehicle searches. In a relatively small town, many of the officers might have encountered vehicles belonging to NFT or her associates over time. It is apparent that from a vehicle search, one could very easily link to the records of associates such as ‘intimate partners’. 24 Exhibit 1, Tab B, 1036. 25 The Commission’s written submissions dated 3 April 2020, [47(b)]. -- 11 of 18 -- 12 In relation to 28 November 2016 specifically, neither BKP nor Constable D claims to have a clear recollection of the occasion. This is unsurprising since they were asked about it approximately a year after the event. BKP’s account is to the effect that if it was him who was using the device at the time, the accesses were the sort of commonplace ones that he would have done during a patrol in connection with a vehicle sighted: checking the vehicle, checking who it was registered to, doing background checks on that person and their associates, and so on. In my view, this is entirely credible. It has not been suggested that officers must adopt a restrictive approach in conducting background checks while on patrol, provided of course that the purposes are operational rather than personal. Flicking from record to record to gain a holistic picture of who might be driving a car and who might be a passenger, to see for example whether someone is unlicensed, wanted on a warrant, or dangerous to approach, is consistent with proactive policing. Constable D’s account does not detract from BKP’s explanation. While she thinks she would have remembered Y’s car if it had been pulled over, the possibility was not canvassed with her that the accesses might have been performed in relation to a car that was sighted but not pulled over. The fact that the accesses began with checks on a car likely to have been out on the streets at the time, and with no obvious connection to NFT herself, suggests that the accesses were routine ones done for operational purposes in the manner described by BKP. I am not persuaded on the balance of probabilities that the accesses, if they were conducted by BKP, were for non-operational purposes. Accordingly, I make no adverse findings against BKP in relation to these accesses. Accesses on Tuesday 7 February 2017 The activity report shows accesses between 3.46 pm and 3.48 pm but the first several relate to vehicles and people where there is no suggested connection with NFT. Accesses with a connection with NFT began at 3.47 pm with an access about a car registered to NFT. There were then accesses relating to NFT, showing her traffic and criminal histories, and her ‘mugshot’. NFT told investigators that her working hours were 9.00 am to 5.00 pm at that time; she believes that she was still unlicensed then; and so the car would have been at her home. Police records indicate that on that day BKP and a number of colleagues were rostered to attend a training course in another town, which according to Constable D is some 88 kilometres from town A. The shifts of these officers ran until 4.00 pm. The investigation report indicates that there were three officers rostered to perform operational duties in town A at the time of the accesses. Two were the officers who said they had never used a QLITE device. The third, Constable G, in April 2018 told investigators that he could not recall using BKP’s device on 7 February 2017 or having any interactions with NFT that day. In response to a broader question, not confined to that date, about whether he had conducted checks about NFT using BKP’s device, Constable G said that he had several interactions with NFT. However, he could not recall if he had conducted database checks on her using BKP’s device. He added that if he had conducted such a check, he would have used his own payroll number and password. -- 12 of 18 -- 13 In his directed interview, BKP said that he did not think he had his QLITE device with him that day and he does not remember remaining at the station to use it at the end of the day. He said he did not recall making the accesses in question. He suggested that some other officer may have made them. He said he had travelled with other officers to and from the training course. As to their time of return, he said they got back ‘almost right on’26 4.00 pm, although he went on to say that he did not recall exactly what time they got back. Prompted by comments about what other officers had told investigators, BKP accepted that they finished duty a little early. Constable D told an investigator in a recorded interview that she travelled with BKP that day, though she could not recall which of them did the driving. She did not recall if they had a QLITE device with them. She could not recall them doing any traffic intercepts while they were travelling. She thought they had left the training centre at 3.00 pm and, while she could not be one hundred per cent certain, she thought they were back in town A and able to leave the station 15 to 20 minutes before the end of the shift. The Commission’s written submissions say that Constable D recalled that the training finished early, ‘at approximately 15:30 hours’,27 before Constable D and BKP then returned to the station in town A. The Commission accepts that if the time of approximately 3.30 pm is correct, BKP could not have been back in town A at the time of the accesses. However, it submits that BKP may have had his device with him while travelling. In response, Mr McMillan for BKP submits that it would have been open to the Commission to obtain evidence about the location of the device at the time of the accesses, but it has not done so. I note that the evidence about the timing of officers’ movements is imprecise, but Constable D thinks that she and BKP were back in town A at what must have been about 3.40 or 3.45 pm. That timing would be consistent with BKP performing the accesses upon his return to town A. For the accesses to have occurred, BKP would have to have logged in to databases then or within the previous 12 hours. Further, NFT’s recollection, albeit untested by cross-examination, is that the car in question would have been at her home rather than on the streets. On the other hand, other accesses unrelated to NFT were initially made. Perhaps these were performed by BKP to create a smokescreen. However, other scenarios are open such as BKP making checks to follow up some queries and then lending his device to a colleague, whether Constable G or another officer who had been on the training course, to enable them to do likewise. I am conscious that Constable G and several other officers have said that any accesses they performed would have been done with their own payroll number and password. However, as has been discussed, that was not uniformly the case. Further, as the discussion about the next date will illustrate, recollections well after the event about mundane matters, such as whether or how a person accessed information on a device, may well be unreliable. Overall, while I consider that the evidence against BKP for this occasion is stronger than that for other occasions, it remains inexact and inconclusive. I am not positively satisfied to the requisite standard that he performed the accesses. Accordingly, I find that the accesses were made by a person unknown. 26 Exhibit 1, Tab B, 1039. 27 The Commission’s written submissions dated 3 April 2020, 13. -- 13 of 18 -- 14 Accesses on Saturday 24 June 2017 The activity report for this day runs to hundreds of pages, with many accesses in respect of which no connection with NFT is suggested. The relevant accesses begin with one at 12.34 am relating to a car registered to NFT, which is not the car mentioned earlier. There was then a series of accesses relating to Z (NFT’s partner) until 12.38 am, and then further accesses relating to Z at 12.57 am. It seems to be common ground that this must have been the occasion referred to by several witnesses when BKP was on patrol with Constable H, and they intercepted a car which, apparently, Z was driving with NFT as his passenger. NFT told investigators that she worked at the hotel until 10.30 pm on this occasion, and that Z would have collected her from work. She said that he used to drive the car in question ‘all the time’.28 She said that at around this time, though she was not sure if it was on that date, BKP ‘pulled us over’.29 NFT described BKP as being in the company of a female officer, and that he did a licence check on Z. In his directed interview, BKP discussed a night when he intercepted a car in which NFT and Z were travelling. Asked about the gap between the accesses on 24 June 2017, and why an image of Z was accessed, BKP said he may have been checking flags for Z and discussing him with his colleague in case they had to deal with him again. He said the vehicle would have been of interest not because it was NFT’s, as there were many such cars around, but because the car was leaving the area of the hotel and so its driver may have been affected by alcohol. BKP went on to say, though, that he was ‘pretty sure’30 that he rather than Constable H was the driver that night, so Constable H would have carried out any database searches using his device. Constable H told investigators that she recalled a shift with BKP involving traffic intercepts, random breath testing, and walk-throughs of licensed premises, though she did not know the date. She recalled that she and BKP intercepted a vehicle in which NFT was travelling, for a random breath test and licence check. She said that ‘checks were done on QLITE and nothing came back on the persons’.31 Constable H continued: As I believe [BKP] was driving I was utilising his QLITE however, I believe I was logged in under my user and password when I did the checks on [Z] and [NFT].32 The Commission’s written submissions comment that ‘street checks’33 were conducted on two other drivers during that shift, but not on Z. However, the significance of this, if any, is not apparent and was not satisfactorily explained at the oral hearing. 28 Exhibit 1, Tab B, 1077. 29 Ibid. 30 Exhibit 1, Tab B, 1044. 31 Exhibit 1, Tab B, 1081. 32 Exhibit 1, Tab B, 1082. 33 The Commission’s written submissions dated 3 April 2020, 14. -- 14 of 18 -- 15 The Commission’s written submissions also say that NFT said that she and Z would not typically have been out after returning home from her shift, and ‘nor would have they been out at 00:35 hours …’34 The basis for these submissions appears to be comments by NFT in an unsigned statement: [Z] would pick me up from work and we would go home, we would rarely go out again after work, if we needed anything for home we would pick it up on the way home, but once we got home, we wouldn't go out again.35 This does not indicate, however, whether NFT and Z immediately travelled home at the end of NFT’s shift. In another passage, NFT said she often stayed at her workplace for 20 minutes or so after finishing work.36 Given the other evidence about the intercept in question, it seems probable that NFT and Z did not leave the hotel on the night in question until after midnight. The Commission concedes in its written submissions that the accesses on 24 June 2017 by BKP or Constable H ‘may have been for operational purposes’.37 In my view, it is not merely possible but probable that the accesses were for operational purposes. There is no suggestion by Constable H that the intercept was for some improper purpose. It is noteworthy that Constable H says that she believes that she made the accesses and that she believes that she used her own payroll number and password. However, the latter belief must be mistaken. If she had used her own payroll number and password, the accesses would not have shown up in the activity report for BKP. Further, NFT’s recollection that BKP did the licence check appears to be mistaken. Accordingly, I find that the accesses were not made by BKP and that they were for operational purposes. Accesses on Saturday 22 July 2017 The accesses occurred during an 8.00 pm to 4.00 am shift when BKP was on traffic patrol with Constable J. The activity report sets out numerous accesses between 12.18 am and 2.45 am, most of them with no suggested connection with NFT. The accesses connected with NFT occurred between 12.35 am and 12.37 am. They related to the car registered to NFT discussed in relation to the previous date, as well as to NFT and the person N who I have mentioned earlier. NFT told investigators that on this occasion she worked until midnight; after work she would often stay around for 20 minutes or so; and she thinks Z would have picked her up. She said that Z was still driving the car in question ‘all the time’.38 BKP’s account in his directed interview in December 2017 is a little hard to follow but seems to be to the following effect. The day before, he and Constable J had run into NFT at a supermarket. He introduced them as NFT could be a useful source of 34 Ibid. 35 Exhibit 1, Tab B, 1077. 36 Ibid. 37 The Commission’s written submissions, [48]. 38 Exhibit 1, Tab B, 1077. -- 15 of 18 -- 16 information because she worked at the hotel. During the shift in question, he saw NFT’s vehicle leaving the hotel but ‘I didn’t intercept because I know who it was … I would have put in the rego, realised it was her …’.39. He thinks he asked Constable J if he remembered NFT from the introduction but he said ‘Which girl?’40 So BKP brought up her picture to show Constable J, ‘because I think it’s the easier way to learn, by faces’.41 BKP and Constable J discussed the assistance that NFT had provided BKP ‘in regards to helping me out with photos and all that sort of stuff’.42 BKP accidentally ‘hit’ the ‘offender street check’43 but he does not recall searching for N. He does not know why searches would have been done about N, but N may have been flagged. He would normally click on any flagged associate of a person, to see why they were flagged and whether they were in town. BKP’s solicitors sent the Acting Deputy Commissioner a submission dated 29 March 2019. It appears to have been written by the solicitors, but it is in the first person. In relation to the shift in question, it says: All of the searches that were conducted were performed for operational reasons and were performed by Constable [J] as I was driving.44 However, this is at odds with BKP’s account in the directed interview. In the interview, although he said ‘I believe we searched the vehicle’45 (apparently meaning online), predominantly he described doing searches himself. It is concerning that the two accounts are not consistent, though it is possible that BKP did not check carefully enough the submission prepared by his solicitors or was by that time confusing this occasion with some other occasion. I consider the earlier version to be more reliable, as it was closer to the events in question. Constable J was interviewed by an investigator by phone on 11 December 2017 about the shift in question. His account was to the following effect. He thinks it would have been a busy night on traffic patrol, because it was a Friday night, but he did not specifically recall. He did not recall who was driving. They would have been pulling over cars, running registration checks, and seeing if the people were associated with anyone who ‘might be dodgy’.46 He does not have his own device, so he would have used BKP’s if BKP was driving. Constable J was asked if they had pulled over NFT, but he said he did not know her at the time so he would not remember. As the interview predated BKP’s directed interview, he was not asked to comment on BKP’s remarks about introducing NFT to Constable J at a supermarket or showing him her photograph. Nor was he asked about the proposition that the car was sighted but not pulled over. A brief introduction at a supermarket and the showing of a photograph of a helpful source would have been unremarkable, and so Constable J may not have recalled them unless specifically questioned. Given that in his directed interview BKP claimed to have a recollection of himself accessing database/s on what was probably this occasion, I am satisfied that the 39 Exhibit 1, Tab B, 1045. 40 Exhibit 1, Tab B, 1046. 41 Exhibit 1, Tab B, 1045. 42 Exhibit 1, Tab B, 1046. 43 Exhibit 1, Tab B, 1045. 44 Exhibit 1, Tab A, 26. 45 Exhibit 1, Tab B, 1045. 46 These words are from the audio recording. No transcript has been provided. -- 16 of 18 -- 17 accesses in question were made by BKP. I regard BKP’s explanation of the reasons for the accesses as credible and convincing. The overall circumstances are consistent with accesses occurring upon sighting a vehicle late at night while on patrol in the vicinity of a hotel, checking any flagged associates, and discussing with a colleague a person willing and able to assist police with enquiries. Accordingly, I find that the accesses were made by BKP but for operational purposes. Accesses on Friday 25 August 2017 BKP worked an 8.00 am to 4.00 pm shift. The accesses in question occurred at 10.26 pm, when searches were conducted on the car registered to NFT that has been mentioned in relation to the previous two dates. Before and after these accesses there were other accesses with no suggested connection to NFT: some from 10.23 pm, and then some from 10.37 pm to 10.40 pm. NFT told investigators that she worked until 9.00 pm that day; and that Z would have picked her up from work in the vehicle in question. In his directed interview, BKP said he would not have logged on after his shift from home. He suggested that the accesses must have been made by another officer during night shift. He said that several officers had his passcode, and any of them may have passed it on to colleagues. He said that if whoever was using his device did not log out of the databases, and log back on in their own names, then accesses would show up as being in his name. Investigators noted that during the night shift, Senior Constable B (who had never used a QLITE device) and Constable D (who at that point had her own device) were rostered on together, and that Constables E and F were also rostered on. Constable D told investigators that she had only ever used BKP’s device in his presence. Further, as she had her own device, and Senior Constable B does not use QLITE devices, neither of them could have carried out the searches in question. Senior Constable B was asked if any of the four officers conducted searches relating to NFT using BKP’s device that night. He said that to his knowledge they had not, adding that he did not know who NFT was at the time. I note, however, that the searches were ‘Get.Vehicle’,47 ‘Search.Vehicle’,48 and similar, which indicates that the vehicle rather than the person was the impetus, at least overtly, for the accesses. Constable E said he did not recall whether any of the four officers used BKP’s device on the occasion in question or whether any of them had conducted the searches in question. Constable F said he did not remember if any of the four officers used BKP’s device that night. He said it was possible, but that it was likely that Constable D would have used her own device. In addition to the above evidence, including the understandably imprecise recollections of Constables E and F, I take into account the practice of widespread sharing of devices at the town A station, the evidence that officers could inadvertently use another officer’s access to databases, and the accessibility of databases for 12 hours after logon in the absence of logout. I also take into account that the accesses in 47 For example, Exhibit 1, Tab B, 781. 48 For example, Exhibit 1, Tab B, 784. -- 17 of 18 -- 18 question were performed amongst other unrelated accesses, and that they related to a car that could well have been leaving the vicinity of a hotel at the time. I am not persuaded that it is more likely than not that the accesses were made by BKP or that they were made for an improper purpose. Accordingly, I make no adverse findings against BKP in respect of these accesses. Conclusion For the reasons explained above, matter 1(d) is not substantiated. The correct and preferable decision on substantiation is therefore to confirm the decision of the Acting Deputy Commissioner. The tribunal will separately issue directions to now progress the other part of the proceeding, which relates to sanction. Finally, I note that a non-publication order was made by the tribunal, until further order, on 25 March 2020. It prohibits publication that would identify BKP and ‘any innocent third party’. In its written submissions, the Commission sought a change to the order so that it would no longer prevent publication revealing BKP’s identity. However, when I indicated that the question of substantiation would be determined initially, and the question of sanction later, the Commission did not press the proposed change in the interim. That was appropriate, in my view. The non-publication order therefore remains in force for the time being. -- 18 of 18 --