An inspection of the south-east regional response to serious and organised crime

Introduction

About our inspection

As part of our overall police effectiveness, efficiency and legitimacy inspections, we inspected how well police forces tackle serious and organised crime (SOC). In 2022, we changed how we inspect this aspect of policing, to incorporate inspections of the ten regions, as well as the nine regional organised crime units (ROCUs) throughout England and Wales, and the 43 police forces. This improves our understanding of how well forces and ROCUs work together to tackle SOC.

About us

His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) independently assesses the effectiveness and efficiency of police forces and fire and rescue services, to make communities safer. In preparing our reports, we ask the questions that the public would ask, and publish the answers in an accessible form. We use our expertise to interpret the evidence and make recommendations for improvement.

About our report

This report includes the following sections.

Regional findings

We provide a summary of inspection evidence that identifies good or poor performance within the region; in other words, involving or relating to the ROCU and its constituent forces. The performance of the region isn’t given a graded judgment. Instead, we highlight areas for improvement, causes of concern and innovative and promising practice in this section, where applicable.

The ROCU and individual forces

We give the ROCU and each individual force a graded judgment. This includes a summary of the findings from our inspection and highlighted sections for areas for improvement, causes of concern and innovative and promising practice.

Terminology used in this report

Our reports contain references to, among other things, ‘national’ definitions, priorities, policies, systems, responsibilities and processes.

In some instances, ‘national’ means applying to England and Wales. In others, it means applying to England and Wales and Scotland or the whole of the United Kingdom.

About ROCUs

Each ROCU serves between three and seven constituent forces (see map in Appendix 1).

The Strategic Policing Requirement defines ROCUs as:

“collaboration arrangements between forces that deliver specialist policing capabilities” and “the primary interface between the NCA [National Crime Agency] and forces”.

It sets out that:

“The ROCU network mission is to protect communities by disrupting organised crime groups, individual criminals and those who enable them.”

The Government’s Serious and Organised Crime Strategy 2023–2028 states:

“ROCUs are the operational and intelligence link between the NCA and police forces in England and Wales and lead the law enforcement response to serious and organised crime in their regions.”

ROCUs provide a range of specialist capabilities to forces. These include the regional organised crime threat assessment (ROCTA) units, surveillance, undercover policing, sensitive intelligence units, regional asset recovery teams, cybercrime teams, the Government Agency Intelligence Network, prison intelligence units and others.

ROCUs are set up under collaboration agreements (made under section 22A of the Police Act 1996) between the chief constables and police and crime commissioners (PCCs) in each region. ROCUs aren’t statutory bodies. They rely on forces to supply the administrative and support functions they need, including human resources, finance and IT. As a result, each ROCU is set up differently, under different terms of collaboration.

Chief constables and PCCs provide most of the funding for ROCUs and additional funding is provided by the Home Office. In each region, forces negotiate their financial contribution to the ROCU.

Changes to how SOC threats are managed nationally

In our previous PEEL inspection reports, we have referred to how well forces have managed and mapped or assessed organised crime groups (OCGs).

In this report, we refer to SOC threats, which encompass OCGs, SOC priority individuals and SOC vulnerabilities.

This reflects changes introduced nationally to provide a “single picture of demand”. This has been achieved by setting up a national database of SOC threats called the SOC master list, which is held on the agency and partner management information system (APMIS). This is used to assess which SOC threat is a priority for each agency or force. It holds information from the National Crime Agency (NCA), ROCUs, police forces and government agencies that tackle SOC. APMIS is also where forces, ROCUs and other agencies record their disruption activity against SOC threats.

Regional findings

The south-east region consists of four forces (Hampshire and Isle of Wight Constabulary, Surrey Police, Sussex Police and Thames Valley Police) and the South East Regional Organised Crime Unit (SEROCU).

SEROCU and its constituent forces should revise their approach to serious and organised crime assessment when national guidance is revised

During our inspection, we found that SEROCU and south-east regional forces have changed how they assess SOC threats. They made this change to improve consistency across the region. But we are concerned that SEROCU and its forces aren’t considering all aspects of a SOC threat.

When SEROCU or its constituent forces identify an OCG in the region, they only apply a management of risk in law enforcement (MoRILE) assessment to the specific aspects of the OCG that are being managed as part of an operation. For example, an operation may only:

• focus on tackling one type of criminality that an OCG is involved in; or
• target a small number of people within the wider criminal network.

This approach means that SEROCU and its constituent forces do not always assess the risks from all criminal activity within the OCG.

This may prevent them from considering the whole SOC threat when deciding how to prioritise resources. And it is likely to make assigning tasks and co-ordination processes less effective. This is the first region that we have inspected that is taking this approach.

Following this inspection, we identified that national guidance for SOC MoRILE assessment doesn’t make it clear how forces and ROCUs should assess SOC threats. This had led to different interpretation of the guidance by forces and regions and inconsistent practice across England and Wales.

We have since raised our concerns about the approach in the south-east region with national bodies such as the Home Office and NCA. The NCA is revising the current guidelines for SOC threat assessments. SEROCU, and representatives from other ROCUs, are involved in this work. Once these guidelines have been approved, the south-east region (and other policing regions) should follow them.

SEROCU is working to improve how the region records disruption activity

SEROCU carried out an audit of disruption activity recorded in the region between April 2022 and March 2023. This identified that some disruptions that had been recorded didn’t meet the national minimum standards for disruption recording. As a result, SEROCU has revised the process, which is improving the way disruptions are moderated.

During operational reviews in SEROCU, we confirmed that some disruption activity wasn’t being recorded. We also found that in some forces, disruption activity was being recorded inappropriately. For example, one force was recording the management of registered sex offenders as a SOC disruption. This isn’t in line with national minimum standards for disruption recording.

During interviews in SEROCU, we found that some teams didn’t fully understand the types of disruption activity that should be recorded. Some personnel we spoke to were frustrated as they felt that some good work they were doing was no longer being recorded as disruption activity. SEROCU personnel are expecting to receive training regarding disruption recording. This training should explain why some work can’t be recorded as a disruption and reassure personnel that the work they are doing is beneficial.

South East Regional Organised Crime Unit

South East Regional Organised Crime Unit (SEROCU) is good at tackling serious and organised crime.

Understanding SOC and setting priorities to tackle it

SEROCU has strategic governance to manage the response to SOC

SEROCU has a control strategy that describes the priorities for the region. Each priority has a strategic governance group and a tactical delivery group. Some of these groups were more well established than others. Senior officers from the regional forces chair these groups.

SEROCU uses a range of intelligence to understand SOC threats

During our inspection, we interviewed ROCTA personnel. They told us that they search various intelligence databases when they receive information relating to SOC. This includes sensitive databases, such as those owned by counter-terrorism policing, and suspicious activity reports.

The SEROCU gateway team receive all requests made for specialist ROCU support. During the last 12 months, the team has introduced a triage process to prioritise requests. There are single points of contact in each of the regional forces who attend tasking and co-ordination meetings. They identify force investigations to the gateway team for SEROCU support.

The regional intelligence bureau (RIB) receives and circulates intelligence across the region. This includes intelligence from the SEROCU sensitive intelligence unit and the NCA. The RIB assesses intelligence from the NCA about illicit commodities, such as drugs, being imported from overseas. It then passes the intelligence to other teams in SEROCU or forces for further investigation.

We found that personnel from the tackling organised exploitation (ToEx) team work with the undercover unit to develop intelligence and gather evidence about people at risk of exploitation. This information is then used by tackling organised exploitation personnel to identify high-risk offenders and act to stop or prevent any offending. We heard about an example when the team used a ‘data scraper’ tool to extract information from websites to help identify vulnerable children online for safeguarding.

SEROCU should improve how it uses technical intelligence

We heard during a focus group that SEROCU has developed online profiles of suspects to assist SOC investigations. But we found senior investigating officers (SIOs) rarely request them for their investigations. Senior leaders in SEROCU should promote the benefits of online profiles within investigation teams, so that they don’t miss investigative opportunities.

Resources and skills

SEROCU should review its surveillance capability

SEROCU has officers trained to carry out surveillance across three investigation teams. As well as surveillance duties, officers in these teams also carry out the role of SOC investigator.

We heard that SEROCU relies on forces in the region for additional surveillance support. Formal agreements were in place to govern the sharing of surveillance resources regionally, which we found encouraging.

We heard from regional leads that there was a plan to review surveillance teams across the region during 2024/25. However, we found no evidence that this review had begun. We encourage senior leaders to start this piece of work. This will help senior leaders make informed decisions about the balance of surveillance resources across the region.

SEROCU has benefitted from additional investment

We were told by the senior leadership team that there was additional funding available for SEROCU. Regional forces have increased their funding contribution by 8 percent. In 2019, regional chief constables and PCCs agreed to increase the number of SEROCU’s operational buildings. SEROCU is expected to move into these buildings during 2024.

At the time of our inspection, the SEROCU senior leadership team had grown to include a new chief superintendent and an additional superintendent to support the senior leadership team.

SEROCU is committed to tackling cybercrime

In 2021, SEROCU and Thames Valley Police decided that their cybercrime units would both come under the command of SEROCU. This means that SEROCU manage and assign tasks to the team, but personnel are still based in the force. SEROCU carried out a review in 2022 to see how this could benefit the other forces in the region. The review identified that the management of cybercrime at a regional level improved how demand was managed and helped to protect personnel from being used for other work in the force. Since our inspection, chief officers from the other three forces in the south-east region have agreed to follow this operating model.

SEROCU is learning from most SOC investigations

Personnel from the SEROCU disruption team told us that they carry out a debrief after each operation. The regional organisation board records this and makes the information available to SEROCU personnel, as well as sharing it with regional forces.

But we found some examples where operational activity wasn’t fully debriefed. The debrief for one operation was cancelled several times. We heard from one senior manager that full debriefs are time-consuming, and that there aren’t enough trained personnel to carry them out.

Tackling SOC and safeguarding people and communities

SEROCU is working with regional SOC partners to tackle SOC in prisons

The regional prison intelligence team has several prison intelligence officers, who monitor SOC offenders in prison. They have developed a process that records information from police and regional SOC partners about prisoners. This helps prison intelligence officers understand any risks presented by individual prisoners continuing to be involved in SOC while in prison.

We also heard that prison intelligence officers were able to identify emerging threats in regional prisons, such as the criminal use of drones (often used to bring drugs into prisons). They were working with HM Prison and Probation Service to reduce and prevent these incidents.

We reviewed an operation concerning an OCG member who, while in prison, was being managed by the multi-agency response to serious and organised crime (MARSOC) team. We were pleased to see that the operation had two LROs appointed; one to manage the threat within the prison, and one to manage the criminal network in the local community.

The regional MARSOC team provided us with a summary report covering this operation. It explained the threat assessment process, the recording of disruptions and work with SOC partners. This demonstrated an effective operational response to disrupt the offending in prison.

SEROCU’s regional disruption team is used to tackle SOC

SEROCU has a regional disruption team to provide support for SOC investigations. It doesn’t lead investigations but supports other teams who need assistance. This includes carrying out overt disruption activities, preparing applications for warrants and supporting SOC partners who have limited investigative powers. Personnel use the regional gateway process to make requests for the team’s support.

During interviews, we found that the regional disruption team was working well with operational teams in SEROCU and regional forces. It had also developed relationships with regional SOC partners, such as trading standards and HM Revenue & Customs.

SEROCU is working to protect victims of SOC

When we interviewed personnel from SEROCU, most were aware of the need to safeguard vulnerable people. The RIB has an on call process to respond to threat to life concerns around the clock.

During a focus group with SIOs, they explained that there is a covert policing policy. This describes the approach they should take to make sure they safeguard vulnerable people. They do this by using local force public protection leads to share information for police and partner intervention.

However, some of the regional SOC partners we interviewed didn’t have enough awareness of what SEROCU could do to respond to safeguarding concerns or to prevent SOC offending. For example, when we spoke to regional SOC partners, only one partner representative was aware of a programme to prevent cybercrime. SEROCU should work more closely with partners to make sure they are confident in dealing with vulnerable people.

SEROCU aims to improve how it works with force LROs

At the time of our inspection, regional forces had accepted a proposal from the head of SEROCU for how they should appoint LROs. SEROCU has also introduced a forum for LROs and SIOs which it intends to hold every two months. It will focus on LRO training, sharing good practice and building relationships between LROs and SIOs.

At the time of our inspection, SEROCU had a regional SOC co-ordinator in place who was assisting forces with plans for the Clear, Hold, Build model. They also appointed a sergeant as a tactical advisor to encourage more work to prevent SOC and protect the vulnerable.

Both officers told us they had experience in neighbourhood policing and problem‑solving with partners. They attend several regional and force meetings to share learning and offer advice.

During operational reviews we saw several examples of LROs working with SIOs in SEROCU. However, in some cases, LROs were over-reliant on SIOs writing 4P plans. This resulted in operations becoming too focused on pursuing offenders. The tactical advisor’s role is to assist LROs when preparing 4P plans.

Hampshire and Isle of Wight Constabulary

Hampshire and Isle of Wight Constabulary is inadequate at tackling serious and organised crime.

Understanding SOC and setting priorities to tackle it

The constabulary should make sure that governance arrangements for managing SOC threats are effective, including any changes made under the constabulary’s restructure

The constabulary produces an annual strategic assessment which identifies and assesses SOC threats using MoRILE scores. The strategic assessment is used as the basis for the control strategy, which defines the constabulary’s operational priorities and allocates senior ownership to each one.

The strategic assessment identified some SOC threats as a priority; for example, serious organised acquisitive crime (such as organised burglary and robbery), modern slavery and human trafficking. However, during interviews with senior managers, we heard that they manage these priority areas in isolation. They acknowledged there was a need to improve.

The constabulary has a monthly tasking and co-ordination meeting to review and prioritise activity at constabulary level and to review selected SOC threats. Area commanders are expected to attend this meeting (or send a deputy). There is also a monthly OCG management meeting, chaired by the director of intelligence. During this meeting, decisions are made about which OCGs are reviewed at tasking and co-ordination meetings. LROs meet the SOC intelligence manager in advance of this to discuss SOC threats and update on progress.

At the time of our inspection, the constabulary told us that it had recently introduced area-level tasking and co-ordination meetings. At these meetings, area commanders should assess the progress LROs are making. But it was too early for us to assess how effective these meetings are.

The constabulary should make sure that it has enough intelligence personnel to understand SOC threats

During this inspection we found that over the last 10 years the constabulary had steadily reduced its intelligence function due to budget cuts. This has reduced the number of analysts and intelligence officers in post. Consequently, there are times when the constabulary needs to prioritise which intelligence documents are produced to support investigations.

A lack of intelligence resource means it has limited capacity to consistently scan intelligence to identify new SOC threats. However, the inspection team was provided with some examples of SOC analytical documents which are produced on a regular basis and are used by local teams.

There isn’t sufficient intelligence resource to consistently meet operational demand. The constabulary SOC unit (SOCU) is responsible for investigating complex SOC. Senior intelligence personnel told us that most SOC threats are identified by the SOCU teams, rather than through the work of the intelligence units. The SOCU teams confirmed that they often had to develop their own intelligence because of insufficient intelligence support. We also heard that LROs didn’t always receive intelligence documents to assist them with their 4P plans.

At the time of our inspection, the constabulary had recognised the need to invest heavily in intelligence teams and an internal bid was being prepared for additional intelligence funding. This funding has since been secured and there is a plan to recruit more intelligence personnel. At the time of publication, it isn’t possible to assess the effect of this investment; it will take time to fully establish these roles. Senior leaders need to make sure that changes made to the intelligence function have a positive effect on the understanding of SOC threats.

The constabulary should make sure it has enough personnel to process intelligence reports

The constabulary has a team that processes intelligence reports submitted by force personnel. At the time of our inspection, we found that half of the posts in this team were vacant. As a result, there has been a backlog of intelligence reports waiting to be processed. The constabulary had introduced a system to risk assess and prioritise intelligence reports. It had also offered overtime to staff. But we found that this still wasn’t sufficient to reduce the backlog to an appropriate level.

The constabulary had identified this as an issue and was planning to increase the number of posts within the intelligence processing team.

Resources and skills

The constabulary senior leadership team had changed just before our inspection. They had introduced a restructure, moving from a functional approach (with separate commands for different types of policing, for example investigation, response or neighbourhoods) to a local area-based approach. This will result in the creation of four local areas to encourage a stronger connection between the constabulary and local communities. Although the restructure was ongoing, people we spoke to during our visit were positive about these changes. They felt that more local ownership would improve the constabulary’s overall performance.

The constabulary should make sure that its workforce understands that SOC is a priority and that information about SOC threats is widely shared

We heard from senior leaders during interviews that SOC hadn’t been promoted as a priority for some time. One senior leader stated that SOC is often considered a specialist matter, rather than a core frontline policing responsibility. Evidence gathered during reality testing tended to support this.

The constabulary told us it had been running an internal communication campaign aimed at increasing local officers’ awareness of SOC threats. This campaign led to an increase in intelligence being submitted by officers and staff. Prior to our inspection, the constabulary published a SOC guidance document on its intranet. While this is a positive step, some officers we spoke to didn’t know about this guidance.

In our reality testing with a selection of neighbourhood officers, we established that some didn’t have up-to-date information about SOC threats in their local area. They told us that intelligence held by some investigation teams isn’t shared; they felt that some teams were too protective of information. Additionally, personnel that we spoke to in one SOCU team only knew the details of investigations they were working on. They weren’t aware of SOC threats across the constabulary’s other geographical areas. If local officers have no knowledge of SOC activity in their area, they are less likely to disrupt criminals or gather vital intelligence.

During our reality testing and focus groups, officers from one SOCU team told us they work in isolation and don’t involve other teams in their investigations. Some officers in the SOCU team told us that they rarely involve local officers in their investigations and tend to only share intelligence at the end of an operation. They rarely involve partners in their work. When investigations are sensitive this may be appropriate, but it should be the exception.

The constabulary’s SOC intelligence manager also isn’t provided with intelligence from SOCU teams. We would normally expect personnel doing this role to be fully aware of all SOC threats in the force. After providing the constabulary with our inspection findings, it has reported that it has made changes to address this.

Despite the work which has already begun, senior leaders should continue with efforts to make sure that everyone in the workforce understands SOC and their role in tackling it.

The constabulary has well-resourced SOCU teams, but needs to monitor the capacity of frontline resources to tackle SOC

Hampshire and Isle of Wight Constabulary has three well-resourced SOCU teams and, at the time of our inspection, it had recently established four local proactive units.

But it only has one surveillance team. Some personnel from the SOCU teams told us that it isn’t always possible to get surveillance support because of the increased demand generated by local proactive units. To manage this increase, the constabulary prioritises the use of surveillance teams at a weekly covert tasking meeting, and any unmet demand is tracked. The constabulary is reviewing options to increase its surveillance capacity.

During interviews with local officers, we heard that there was a problem with neighbourhood policing teams being diverted from their main duties. Officers from the neighbourhood teams frequently supplement response teams. Since December 2023, a change in the constabulary’s policy has meant more crimes are being allocated to neighbourhood officers to investigate. Some interviewees told us that this will further reduce the amount of time they can dedicate to tackling local problems. Since our inspection, the constabulary has informed us that it is appointing some neighbourhood officers to work on local problem-solving, which may include tackling SOC.

The constabulary should make sure that LROs receive consistent training and support

The constabulary appoints chief inspectors and superintendents as LROs. Some LROs appoint inspectors as deputies. Some LROs we interviewed told us that they had received training for their role in March 2023 and there was continuing professional development. Prior to this there had been no training for the LRO role.

The constabulary has assured us that it checks attendance at LRO training. But two LROs we interviewed told us that they had been appointed without any training. They had been allocated OCGs to manage and had struggled to get support from SOCU teams or intelligence teams.

The constabulary should make sure that it trains LROs and their deputies to a consistent standard.

The constabulary has recruited an OCG co-ordinator; the post had been vacant until September 2023. The co-ordinator works with LROs to make sure that SOC threat assessments are up to date. Some LROs were concerned that not all OCGs in the force area had been identified. They anticipate that the new OCG co-ordinator would help to improve this.

Tackling SOC and safeguarding people and communities

The constabulary is working with partners to prevent SOC and protect victims

The constabulary employs a SOC partnership co-ordinator. Their role is to identify individual and community vulnerabilities to protect victims and prevent SOC from happening. An example of this was in working with other forces and agencies to understand keyless car thefts. They identified specific communities within the constabulary’s area that were vulnerable to this type of crime and gave advice on how to protect against it.

We found several other examples of personnel working with partners to tackle SOC‑related vulnerability. For example, integrated offender management teams in the constabulary work with a charity that provides an abstinence house to support people struggling with substance misuse.

Operation Defender is a multi-agency response to tackle issues linked to the night‑time economy. Participants include security agency staff, licencing departments, the South-Central Ambulance Service and street pastors. They collect intelligence about individuals causing difficulties in the area.

Operation Fortress aims to tackle drug-related violence and safeguard victims of cuckooing. This sees local police officers working with partners, such as local councils and the British Transport Police, to tackle these issues.

The Office of the PCC has funded navigators in three hospitals and three custody suites. They try to divert people away from violent crime.

The constabulary also helps protect young people who regularly go missing by offering them to volunteer to use technology that tracks their location.

Surrey Police

Surrey Police requires improvement at tackling serious and organised crime.

Surrey and Sussex Police work together to tackle certain elements of SOC. They have shared governance and leadership arrangements, as well as joint specialist investigation teams. But they also carry out some work independently.

In this section, we set out our findings about the way the two forces work together to tackle SOC and describe the work that Surrey Police does independently.

In the section on Sussex Police, we describe the work the force does independently to address SOC.

Understanding SOC and setting priorities to tackle it

Surrey Police and Sussex Police have strategic governance processes to manage the response to SOC

Surrey and Sussex Police have a joint control strategy. This document sets out the priorities across both force areas and outlines what needs to be done to tackle them. They also share a SOC strategy containing four objectives. A joint oversight board governs progress of the SOC strategy.

The forces have identified priority SOC threats, such as criminal use of firearms and county lines. Each force appoints a thematic lead to each identified SOC threat. These thematic leads provide updates to the SOC strategic board and tasking and co‑ordination meetings.

Each force holds its own local tasking and co-ordination meetings; these then feed into the joint force tasking meeting. We observed some of these meetings and found that they had representation from each force and a clear focus on priorities.

The force should improve how it uses SOC local profiles to inform its local policing response

The force produces SOC local profiles annually. SOC partners contributed to the compilation of these profiles. We were pleased to find that they use the profiles during partnership meetings to direct partnership activity. But, when we visited frontline teams, we found that they had limited knowledge of these documents and their content. We found little evidence of SOC local profiles informing activity at a local policing level.

Resources and skills

The force is planning to improve training for LROs

The force appoints inspectors or chief inspectors as LROs from both uniform and detective roles. During an operational review, personnel told us that the force used to appoint officers from the SOCU team as LRO to SOCU investigations. This changed in 2023, when the force decided that a local LRO would be provided even for specialist investigations to improve the overall response to SOC.

Prior to our inspection, we identified from documents that senior leaders had concerns about the capability of LROs and how they were held to account. LROs have received some training regarding the role, but Surrey and Sussex Police have jointly arranged further training. For example, they told us they had planned a professional development day for LROs shortly after our inspection had concluded.

The force is learning from SOC investigations

The force has eight newly trained and accredited personnel responsible for carrying out a thorough debrief at the end of every investigation. In addition, the force has an organisational learning library for keeping a record of learning from investigations. The force intranet contains debriefs and learning, including a section called the Operation Falcon masterclass to improve investigations. We comment further on the force’s approach to reviewing investigations, including Operation Falcon, in our 2023–25 PEEL inspection report.

Tackling SOC and safeguarding people and communities

The force works with SOC partners

Surrey Police has 11 local policing areas. Each of these has a SOC Joint Action Group (JAG). These groups include SOC partners and meet every three months. They are chaired by a police inspector. They share information relating to SOC at these meetings.

But we heard from some attendees that meetings were regularly cancelled. We also heard that frequent changes in local senior police leaders hindered these groups.

The force has identified a location to pilot Clear, Hold, Build. Activity was due to start in November 2023. Some SOC partners we interviewed were aware of the selected location but hadn’t been briefed on any plans.

The force is working to prevent SOC and protect victims

Surrey Police has several established schemes to deter vulnerable young people from becoming involved in SOC. These include Music to My Ears, which is run by charity Catch 22. It teaches young people skills such as music production and creative writing. The force also offers young people who regularly go missing the opportunity to volunteer to use technological solutions to track their location, which helps protect them.

In response to young people’s concerns about gangs and drug use, the force also worked with SOC partners to improve facilities in a local play park. The force told us that, following the work on the park, a survey of local young people indicated an improvement in their perception of the police. We also commented on the force’s work to problem-solve local crime and antisocial behaviour in our 2023–25 PEEL inspection report.

The force is managing its SOC offenders

The force has a specialist unit, known as the high harm unit, to advise force teams who are applying for preventative orders at court. The force told us that the courts had granted 17 SCPOs to prevent reoffending. We found that relevant SOC partners such as HM Prison and Probation Service were working well with the force to manage the release of SOC offenders from prison.

But we were surprised to find that some personnel in the high harm unit were unaware of the MARSOC process. None of the personnel from the unit knew if any of the offenders they were managing were part of an OCG.

Surrey Police and Sussex Police are working together to prevent fraud

Surrey and Sussex Police have a joint economic crime unit. This team is focused on protecting victims of fraud. The team told us that it had prevented £3m worth of fraud.

The forces use funding returned from proceeds of crime investigations to recruit fraud prevention officers. These officers work with police community support officers from neighbourhood teams to offer advice to vulnerable victims of fraud. The forces have developed a performance dashboard to monitor their progress on preventing fraud. This helps supervisors and senior managers to track the progress of live investigations, and to understand patterns of offending and the profile of victims of fraud.

Sussex Police

Sussex Police is adequate at tackling serious and organised crime.

Sussex Police and Surrey Police work together to tackle certain elements of SOC. They have shared governance and leadership arrangements, as well as joint specialist investigation teams. But they also carry out some work independently.

In this section, we describe only the work that Sussex Police does independently to tackle SOC. For more information on what Surrey Police and Sussex Police do jointly to tackle SOC, please see the section on Surrey Police.

Understanding SOC and setting priorities to tackle it

The force uses SOC local profiles to inform their local policing response

Sussex Police had SOC local profiles for the three force geographical divisions, which they refreshed every three months. Some SOC partners told us that they had contributed to the compilation of these profiles. We were pleased to find that they reviewed and updated these profiles during partnership meetings.

At the time of our inspection, the force had recently published these profiles on its intelligence system, making them available to personnel across the force area. But some of the frontline teams we visited weren’t aware of local profiles.

Resources and skills

There is training and support for LROs in the force

The force appoints inspectors or chief inspectors from investigative and neighbourhood roles as LROs. These LROs take responsibility for managing specific SOC threats. Generally, LROs are allocated no more than three SOC threats to manage at any one time.

The force has adapted a training package from another force to use when training its LROs. Some LROs told us that they had attended an event led by SEROCU covering the role of the LRO.

The force is learning from SOC investigations

The last time the force was inspected for SOC was in 2017. The report we published for this inspection included an area for improvement concerning how the force learns from operations and understands its effect on SOC. During this inspection, we found that the force had introduced a learning board to review operations. The force told us that during the last 12 months the learning board had considered 31 submissions relating to SOC. Operational staff we interviewed were aware of this process.

The force’s approach to briefing its frontline staff is inconsistent

The force has an IT system to brief frontline staff on current threats and priorities. However, we found that the section covering SOC contained little information about specific threats. During reality testing with frontline teams, we found that their use of this system is inconsistent. For example, some teams use it daily, whereas others only use it weekly.

Tackling SOC and safeguarding people and communities

The force works with SOC partners

Overall, we found that the force works well with SOC partners to tackle SOC. There are local partnership tasking meetings. Some are co-chaired by senior police officers and executives from the local authority. Meeting attendees discuss current operations and actions are allocated to SOC partners. The force has developed a process for SOC partners to directly share intelligence, and information-sharing agreements are in place.

Some partners we spoke to were concerned that they had to attend multiple meetings covering similar topics. They believed more could be done to make the partnership structure at local and force levels more efficient.

Sussex Police has identified a site for Clear, Hold, Build. SOC partners have been involved in planning this, including developing a community communication plan and establishing an increased police presence in the local area.

The force is working to prevent SOC and protect victims

The force works with SOC partners to tackle cuckooing. Potential victims are given access to agencies, including housing and drug misuse teams, for support. There is also a multi-agency meeting that deals with complex cases. One area of the force uses Operation Adder to reduce drug-related harm. This includes a drop-in centre for users to visit and access available support. Personnel from the police and SOC partners reported to us that this has reduced drug-related harm.

The force has appointed three exploitation co-ordinators. We found that they were providing LROs and SIOs with advice and guidance on investigating cases involving exploitation and safeguarding victims. They also work with SOC partners to improve communication with different communities and explain hidden harm.

In Brighton and Hove, the force has a co-ordinator funded by the Home Office to tackle SOC threats in the Western Balkan communities. We found that the co‑ordinator was working well with SOC partners. But they weren’t always working with LROs. For example, we heard about two active Western Balkan OCGs operating in the force’s area; the co-ordinator hadn’t been involved in these investigations.

The force is managing its SOC offenders

Sussex Police has an integrated offender management (IOM) team, based with His Majesty’s Probation Service. The IOM team manages approximately 20 SOC offenders and had 14 live SCPOs in place. It works well with local policing teams and other SOC partners including the regional prison intelligence unit and the MARSOC team.

The IOM team advises other force personnel about ancillary orders, including SCPOs. Ancillary orders are imposed to:

• prevent crime;
• restrict the criminal activity of an offender; or
• achieve restorative justice.

Breaching an ancillary order is a criminal offence. They also consult with the SCPO co-ordinator at SEROCU, who they use to support officers applying for SCPOs.

Once a SCPO is in place, the IOM team proactively monitors the activity of offenders to identify any breaches of the order. The IOM team works with SOC partners to manage prisoners six months prior to their release if they are subject to a SCPO.

Thames Valley Police

Thames Valley Police requires improvement at tackling serious and organised crime.

Understanding SOC and setting priorities to tackle it

The force is establishing strategic governance to manage the response to SOC

The force has identified SOC as a priority and has a strategic plan to tackle it. In July 2023, the force introduced a strategic tasking meeting, chaired by the deputy chief constable, to manage the plan. The plan identifies and raises actions to address intelligence gaps.

An assistant chief constable chairs the force’s tasking scrutiny and oversight meeting, which reviews the highest risk SOC threats; the top 20 threats are considered. Local policing area (LPA) commanders hold fortnightly reviews of SOC threats to consider any new intelligence that needs to be actioned. If LPA commanders need further support, they can refer to a specialist SOC detective inspector or to the chair of force tasking meetings who makes decisions on the allocation of resources.

The force has a central force intelligence bureau and localised force intelligence hubs in each of the eleven LPAs. The LPA intelligence hubs provide intelligence support seven days a week, 24 hours a day. During inspection, we were told that the central force intelligence bureau and local LPA intelligence hubs work well together to make sure that they share intelligence and act upon it at the appropriate level. They do this through local and central force tasking processes.

Resources and skills

At the time of our inspection, the force intended to reduce the 11 local policing areas to five. The senior leadership team felt that this would help simplify the force structure and bring more consistency. It wasn’t clear during our inspection how this would affect the structure or function of local teams, the force intelligence functions or investigation teams.

Local proactive teams tackle SOC

SOC proactive teams are responsible for pursuing offenders and suspects involved in SOC in their area. Their deployments are managed at tasking and co-ordination meetings and through an app that directs officers from across the force to high-harm areas. They also work to tackle county lines across the force area, working with other forces such as the Metropolitan Police.

We found that officers in the SOC proactive teams generally had a good awareness of available tactics to tackle SOC. They had also developed good relationships with SOC partners and other police and intelligence teams.

The force has significant surveillance capability

The force has four dedicated surveillance teams. Additionally, there are two SOCUs, consisting of a detective inspector and 12 constables. Some of the SOCU team constables are trained to carry out surveillance on their own operations. The force told us that they are frequently asked to provide surveillance support to other regional forces and SEROCU. The force reviews surveillance deployments to make sure that they are providing value for money.

The understanding of SOC in local teams was inconsistent

In our 2016 PEEL inspection report we included an area for improvement relating to the knowledge of local policing teams about SOC in their areas. During this inspection, most of the neighbourhood officers and staff we spoke to had a good understanding of local SOC threats. However, some officers we spoke to from local investigation units didn’t know which OCGs were operating in their areas and were unaware of 4P plans.

There is training and support for LROs in the force

The force appoints either the head of SOCU or local superintendents as LROs. SOC threats are allocated to them for management, depending on whether a local or specialist response is appropriate. The force had designed training and guidance on the LRO role in 2022; during interviews, personnel told us that all new LROs are given this training. We found that the guidance covered key topics that LROs should be informed on, such as SOC threat assessment and disruption recording. We have given the force an area for improvement about the quality and consistency of 4P plans. LROs may benefit from training to improve how they design and use 4P plans.

Tackling SOC and safeguarding people and communities

The force doesn’t record all SOC disruption activity

We found that the force has a process to record and moderate disruption activity. Generally, the personnel we spoke to in SOC-related roles understood the importance of recording disruptions.

However, during reality testing, we found examples of local policing teams and SOC partners working to tackle SOC. They didn’t always record these as SOC disruptions.

Senior leaders and personnel told us that there was a shortage of licences for the agency and partner management information system (APMIS). In one local policing area, only one license was available, meaning one person was responsible for all disruption recording. The force told us that they were making more licenses available, and they would train more personnel.

The way in which the force works with multiple local authorities can make working with SOC partners complex

The force told us that as part of a restructure it was reducing the number of local policing areas to five. However, local policing boundaries can span multiple local authority areas. This means that some local policing teams must work with more than one local authority. On occasions this has caused difficulties when tackling SOC in different areas. For example, senior leaders in one policing area told us that the complexities of working with multiple partner organisations was a barrier to obtaining partnership data for SOC local profiles.

But most local policing supervisors we spoke to were confident that they were working effectively with local authority partners. Partners we interviewed had some concerns that moving to a five LPA model would have a negative effect on police visibility and involvement with communities.

The force is working to prevent SOC and protect victims

During interviews and reality testing, personnel told us about several initiatives to prevent people becoming involved in SOC. These include:

Operation Deter aims to identify, intervene and provide support to under‑18s at risk of becoming involved in serious violence and knife crime. Those who continue to offend are dealt with through criminal justice processes.

The Boxing Clever scheme was developed in Milton Keynes by the police, the Office of the PCC and a parish council. It uses boxing and other support sessions to equip young people with better life skills. Schools and other partner agencies can nominate individuals that they think will benefit from the programme, such as those who repeatedly miss school.

Senior leaders reported that the force works with schools and the Crown Prosecution Service to tackle serious violence and knife crime. An app directs local policing teams to relevant hotspot areas. They patrol, work with the public and enforce, to reduce the risk of serious violence. Senior leaders told us that this had resulted in over 20,000 patrols in 67 hotspot areas. They reported an increase in charge and remand for knife possessions, as well as uptake in diversionary schemes run by the youth offending team.

Local policing teams use an online community information sharing resource (Commonplace) to identify young people susceptible to becoming involved in OCG activity. They upload specific questions to community members living in a problem area. These questions aim to understand more about young people who may benefit from diversion into supportive schemes, such as Friday night football.

The force is managing its SOC offenders

The force has a lifetime offender manager (LOM) who co-ordinates SCPOs. The force told us that they were managing 22 live SCPOs at the time of our inspection. The LOM allocates a severity rating to each SCPO when it is issued. The LOM also works with the SEROCU prison intelligence unit and the SEROCU disruption team to manage offenders and SCPOs effectively. But we did hear that the LROs could consult the LOM more regularly when they prepare their 4P tactical plans.

The force effectively protects victims of fraud

The force has a team of 40 personnel that investigates fraud and safeguards victims. We heard from members of the team that it has led 140 investigations, recovering £220,000 for victims of crime.

The team identifies potential victims of crime by reviewing submissions from Action Fraud. It then produces individual packages to protect these victims. These are then shared with local policing teams who contact the victims and provide guidance and support.

The City of London Police carried out a peer review of the team which identified four areas of good practice. They were:

• automatic upload of data about victims from Action Fraud to the force’s crime and intelligence system;
• establishing a multi-agency group to tackle fraud;
• two officers providing a fraud protection role; and
• a review of working practices that led to an improvement in how the force tackles fraud.

Appendix 1: Map of regional organised crime units

There are ten regions in England and Wales containing nine regional organised crime units:

1. The North East Regional Organised Crime Unit covers Cleveland, Durham and Northumbria.
2. The Yorkshire & the Humber Regional Organised Crime Unit covers Humberside, North Yorkshire, South Yorkshire and West Yorkshire.
3. The North West Regional Organised Crime Unit covers Cheshire, Cumbria, Greater Manchester, Lancashire, Merseyside and North Wales.
4. Tarian covers Dyfed-Powys, Gwent and South Wales.
5. The Regional Organised Crime Unit for the West Midlands Region covers Warwickshire, West Mercia, West Midlands and Staffordshire.
6. The East Midlands Special Operations Unit covers Derbyshire, Leicestershire, Lincolnshire, Northamptonshire and Nottinghamshire.
7. The Eastern Region Special Operations Unit covers Bedfordshire, Cambridgeshire, Essex, Hertfordshire, Kent, Norfolk and Suffolk.
8. The South West Regional Organised Crime Unit covers Avon & Somerset, Devon & Cornwall, Dorset, Gloucestershire and Wiltshire.
9. The Metropolitan Police Service, the City of London Police and British Transport Police work collaboratively in the London region.
10. The South East Regional Organised Crime Unit covers Hampshire, Surrey, Sussex and Thames Valley.

There is a separate collaborative arrangement for the London region, incorporating the constituent forces of the Metropolitan Police Service, the City of London Police and British Transport Police. The forces share some ROCU capabilities.

Appendix 2: Data methodology and caveats

The data used in this report was extracted from the national database: the Agency and Partners Management Information System (APMIS).

APMIS contains data that is recorded by police forces throughout England and Wales, ROCUs, the NCA and other organisations (such as HM Revenue & Customs and Home Office Immigration Enforcement).

This data includes:

• The SOC master list, which contains all MoRiLE assessments for the SOC threats identified by forces and organisations.
• Event-based disruption data (‘disruption data’) that is recorded following national minimum standards. At the time of our inspection, minimum standards stipulated that disruption data should only be recorded against organised crime groups, and not priority individuals or SOC vulnerabilities.

MoRiLE assessment data was extracted from APMIS on 1 June 2022 and therefore any changes made to assessments since that date will not be accounted for in the analysis. The following filters were used on columns to extract this data: Type is Tactical, Moderation status is Moderated, SOC is SOC, Tier is not Tier 5 and Phase is not contains closed.

Disruption data was extracted from APMIS in June 2022 and includes all disruptions made after 1 June 2021. The following filters were used on columns to extract this data: Disruption type is Lead Disruption, Record data is greater than 1 June 2021 and Assessment Category is Major, Minor and Moderate.

Back to publication

An inspection of the south‑east regional response to serious and organised crime