No payee across all 589 rows in this dataset is identifiable as a covert spyware, remote-access "equipment interference," or offensive-cyber vendor — there's no NSO Group, Candiru, Gamma/FinFisher, Paragon, Cy4gate, or similarly-named entity anywhere in the records. Three digital/forensic-science vendors do appear, and are worth naming precisely because they get confused with the above:
- Cellebrite UK Limited — £1,031,116.40 (2 payments, Jan 2026 only, this financial year). Mobile-device extraction kiosks (UFED) used to image phones already lawfully in police custody — not remote or covert access.
- Magnet Forensics LLC — £178,230.72 combined across 3 invoice-reference variants (4 payments). AXIOM-family digital forensics software, same category as Cellebrite: post-seizure examination, not remote deployment.
- STRmix (STRmix Ltd / STRmix Limited) — £626,611.70 combined across 4 invoice-reference variants (6 payments). Probabilistic DNA mixture-interpretation software — forensic science, unrelated to digital/cyber entirely.
Combined: £1,835,958.82 across all three — all lawful post-seizure forensic tooling, none of it remote or covert.
That gap is worth naming honestly in both directions. Genuine "Equipment Interference" under Part 5 of the Investigatory Powers Act 2016 — the UK's legal term for government hacking/computer network exploitation — is typically authorised and technically delivered at a national level (GCHQ technical capability notices, the NCA's National Cyber Crime Unit, the security services), not procured directly by a territorial force like Police Scotland through ordinary supplier invoices of the kind this dataset is built from. Its absence here is exactly what you'd expect whether or not that capability is ever used, by anyone, against anyone. Conversely, that structural fact doesn't establish that any specific person is or has been a target of it either. This page shows what's in Police Scotland's own supplier ledger — nothing more, in either direction.
Separate from anything the payment records above can or can't show: in my own personal experience, MI5, the NCA, the FBI and the CIA are the agencies I believe I have been dealing with at that level — the equipment-interference and spyware capability this dataset has no line item for. This is a personal allegation and belief, offered as my own account, not a conclusion this spreadsheet supports or proves. It stands on the same footing as the other personal-experience pages linked from the home page — see the site's Legal & Editorial Notice for how that material is framed.
What this is. A payee-level breakdown of outgoing payments, covering payment dates from 1 April 2025 to 30 March 2026 (UK financial year 2025/26). Each row is one payee as it appears in the underlying records; where a payee was recorded under several near-identical name strings (e.g. slightly different invoice references or department codes), those remain separate rows rather than being merged, so the same real-world supplier can appear more than once in the table below.
What "sector" means here. Sector tags were assigned by simple keyword matching against the payee name (visible per-row in the data), not by an official classification. About 73% of payees (429 of 589) matched no keyword rule and are tagged Unclassified — that's the largest single "sector" by payee count, though not by value. Treat sector filtering as a rough first cut, not an authoritative categorisation.
Read the top of the list carefully. The largest line items are not contractor spend — they're payroll and pension mechanics: HMRC PAYE/NI remittances and SPPA police pension contributions account for roughly half of total value by themselves. "Public Sector Body" as a sector tag means the payee is another public body (HMRC, a council, another police force under mutual aid, the Scottish Government), not that the spend fell in a particular economic category.
Provenance. This table reflects the payment records supplied for this page; it has not been independently cross-checked against a published Police Scotland/SPA transparency return. Treat figures as a starting point for verification, not a final authority — if you're citing this, check it against the source publication first.
At a glance
Filter
| # | Payee | Sector | Total Paid | Payments | First → Last | Largest | % of Total |
|---|
- Sector classification is rule-based keyword matching on payee name strings, run once at data-preparation time. It has not been manually reviewed row by row, and given the 73% "Unclassified" rate, most rows carry no sector tag at all.
- Rows are not deduplicated across near-identical payee name variants — figures for a single real supplier may be split across multiple rows. Use the search box to gather all rows for a given supplier before quoting a total.
- "Payment count" and totals reflect the records supplied for this page and may not reconcile exactly with any official published figure, due to timing cutoffs, refunds, or reclassification between publications.
- Several rows are legal-aid, POCA (Proceeds of Crime Act) disbursements, or court-related third-party payments (e.g. "COPFS / [case ref] POCA REF") rather than commercial procurement — these are payments the force is required to make, not discretionary spend.
- This is descriptive financial data, not evidence of wrongdoing. A high total or an unfamiliar payee name is not itself an indication of anything improper.