Regulation of Investigatory Powers Act 2000/Part III

Regulation of Investigatory Powers Act 2000 part III (RIPA 3) gives the UK power to authorities to compel the disclosure of encryption keys or decryption of encrypted data by way of a Section 49 Notice. A suspect instructed to disclose keys can be prevented from telling anyone else about it, outside of their legal representative. Refusal to comply can result in a maximum sentence of two years imprisonment, or five years in cases involving national security or child indecency.

After a 2006 Home Office consultation on a Code of Practice for its operation, it came into force in October 2007..

Terrorism Act 2000 Schedule 7 has also been used by police to compel the disclosure of passwords.

Executive Summary

Part 3 of the Regulation of Investigatory Powers Act 2000 gives authorities powers to order the disclosure of encryption keys, or force suspects to decrypt encrypted data. Anyone who refuses to hand over a key to the police would face up to two years' imprisonment. Under current anti-terrorism legislation, terrorist suspects now face up to five years for withholding keys.

While RIPA came into force in 2000, the government had held back from bringing Part 3 into effect for five years. In 2006 Liam Byrne, the new Home Office minister of state, promised Parliament that he would activate Part 3 after a consultation. The consultation received the same negative comments during the consultation that the legislation received when first brought before the commons, but this time with less press coverage. There were concerns that the legislation will have negative effects on business, plus objections from encryption experts that it would fail to achieve its objective while introducing new problems.

Relevant authorities

Per Section 49(1)(e) the power to make Section 49 requests is limited to material in the possession of

• any of the intelligence services (GCHQ, MI5, MI6)
• the police
• National Crime Agency
• Her Majesty's Revenue and Customs

Consultation

Simon Watkin (home office) "Public consultation on draft codes of practice for both Part I Chapter II and Part III of RIPA will open in the week commencing 5 June."

Bob Spink MP (Mole Valley) (Con) brought forward a motion to increasing the sentence up to ten years for suspected paedophiles because for a paedophile the alternative penalty, if the information was turned over, would often be five years or more and, frequently, having to go on the sex offenders list. The government said they liked the idea and that it was time to activate Part 3 of the act but that there should be a consultation first, Bob Spink agreed and withdrew the motion.

From the Home Office FAQ on RIPA "The measures in Part III are intended to ensure that the ability of public authorities to protect the public and the effectiveness of their other statutory powers are not undermined by the use of technologies to protect electronic information."

Problems and Concerns

Your average individual could easily come into problems because they had lost a key: how do you prove to the police that you do not have the key and you can not decrypt the data?

In the worse case situation someone accidentally emails you an encrypted message that you do not possess the key to decrypt. The police then arrest you and instruct you under part 3 of the RIP bill to decrypt the message and hand over the key. You are unable to do this as you do not have the key so now you face a 3 year jail sentence as you can not prove the negative that you do not have the key.

For banks the most controversial part is not the requirement to decrypt encrypted data, but that the police can require that the keys used to do the encryption are handed over. Authorities tracking the movement of terrorist funds could demand the encryption keys in use by a bank through which those funds might be moving, thereby laying bare that bank's files on everything from financial transactions to user data.

A London School of Economics report, commissioned by the Confederation of British Industry, estimated that the law will cost UK industry £46bn over the next five years as businesses move their electronic dealings offshore, and new ventures go elsewhere in search of a more secure trading environment.

Simon Davies, visiting fellow at the London School of Economics, said

"The main issue is the loss of trust in international business dealings. If an overseas partner can't guarantee a high level of security, it simply won't do business with the UK."

The economic impact of the regulation of investigatory powers bill An independent report prepared for the British Chambers of Commerce.

The argument is, at heart that only a complete clueless security officer would ever permit a multi-national financial institution to keep their master keys in the UK. Hence security jobs -- looking after those master keys -- will migrate elsewhere and hence, eventually, so will the rest of the HQ staff; with a consequent effect on the UK economy.

Richard Clayton a security expert from Cambridge University

"The notion that international bankers would be wary of bringing master keys into UK if they could be seized as part of legitimate police operations, or by a corrupt chief constable, has quite a lot of traction," ... "With the appropriate paperwork, keys can be seized. If you're an international banker you'll plonk your headquarters in Zurich."

June 08, 2006 the draft code of practice has come out.

Peter Fairbrother

"This isn't a Code of Practice - it's just a repetition of RIPA in different words."

"It is, as ever, almost impossible to prove ‘beyond a reasonable doubt’ that some random-looking data is in fact ciphertext, and then prove that the accused actually has the key for it, and that he has refused a proper order to divulge it,"

Richard Clayton

"The Home Office appear sensitive to the suggestion that every financial institution will remove their keys (and hence a lot of jobs) from the country,"

"There is a brand new safeguard in that the head of the Financial Services Authority must now countersign requests. But this only applies to "financial services" and not to, say, a company like Ebay, or a British competitor."

"It gets worse. There is a brand new suggestion that demanding keys might become commonplace — when there might otherwise be doubt as to whether a decryption has been done correctly. This means that instead of asking for keys being highly exceptional, as parliament clearly intended, it will in fact become common," said Clayton.

Analyses a variety of bad scenarios by Dr C. H. Lindsey

Nicholas Bohm

But doesn't the availability of plausible deniability products like TrueCrypt render all this moot? (Not to mention MOOT.) The prosecution cannot prove that there are keys they have not been given, provided they are given at least one.

Are these powers really needed?

wtwu of Spy Blog points out Last year's annual reports mandated under RIPA, by both the the then Interception Commissioner Sir Swinton Thomas and the then Intelligence Services Commissioner Lord Brown of Eaton-under-Heywood both contained this identical paragraph:

"However, the use of information security and encryption products by terrorist and criminal suspects is not, as I understand, as widespread as had been expected when RIPA was approved by Parliament in the year 2000. Equally the Government's investment in the National Technical Assistance Centre - a Home Office managed facility to undertake complex data processing - is enabling law enforcement agencies to understand, as far as necessary, protected electronic data."

See Report of the Intelligence Services Commissioner for 2004 - Lord Brown of Eaton-under-Heywood and Report of the Interception Commissioner for 2004 by the Rt.Hon. Sir Swinton Thomas.

Background

There was a mini-debate in the Commons on the 10 May 2006 about changing the sentence for RIP Part III offences when the encrypted material. House of Commons debate Wednesday, 10 May 2006

Sir Paul Beresford (Mole Valley) (Con)

Many of the images are in the form of videos or DVDs or are on computers. Increasingly, they are kept on remote storage. Some of the computers that the police collect have no hard drives at all. They are driven or initiated by a disk and the information is stored remotely. Increasingly, the information is hidden by encryption. We used to have simple encryption, but we have moved to 128 bit and, even more, to 256 bit encryption. The software is freely available on the internet and relatively easy to use. Essentially, it is unbreakable.

The other thing that particularly alarms me is that Vista, which is the replacement for Windows OS, is due out generally next year. Once that system is on board the security is such that, when the computer is turned off, it automatically encrypts all the information on it so that when the police collect the computer and turn it on, they cannot break through the encryption. Some information can be destroyed, preventing access by the police. The police clearly need access for obvious reasons. They need to seek evidence against individuals and, frequently - -- because offenders sometimes work in packs or groups -- against others. In a way, perhaps it is even more important that the police can identify the children in the photographs and movies. Once those children have been located, it is possible to seek care and counselling for them to try to bring them back into a normal life. There is some evidence that abused children go on to become abusers themselves.

The new clause deals with encrypted data found on computers and storage in cases where the police believe that the encrypted data contains abusive images of children. It does not create any new offence or scheme, but rather amends the sentencing regime under section 53 of the Regulation of Investigatory Powers Act 2000, which is commonly known as RIPA. Part III requires a person to comply with a notice issued by the police to hand over the encryption key for protected data. The penalty for a breach is two years, but that is ludicrous for a paedophile because the alternative penalty, if the information was turned over, would often be five years or more and, frequently, having to go on the sex offenders list. Accordingly, it is unlikely that an offender who has indecent and abusive photographs of children on his computer would comply with the notice. To achieve compliance, we need to step up the penalty, so I suggest that such offenders should be liable for up to 10 years' imprisonment, which is the penalty for contravening section 1 of the Protection of Children Act 1978 -- there is thinking and a link behind the idea.

The new clause would simply raise the sentence if a court was satisfied that it was more than likely that the majority of the encrypted data consisted of indecent photographs of children. I suggest that the civil burden is permissible because the offence would be not possessing the photographs of children, which would be punished separately, but the failure to hand over the key. The higher sentence would apply only when one of two thresholds was passed: first, that the computer had non- encrypted indecent photos of children or a child on it, as an indication; or, secondly, that the person had been previously convicted of an offence contrary to section 1 of the Protection of Children Act 1978 or section 160 of the Criminal Justice Act 1988.

Liam Byrne Home Office minister

The use of encryption is, as the Hon. Member for Mole Valley pointed out, proliferating. Encryption products are more widely available and are integrated as security features in standard operating systems, so the Government have concluded that it is now right to implement the provisions of part 3 of RIPA, including section 53, which is not presently in force.

The threat to public safety posed by terrorist use of encryption technology was recognised in section 15 of the Terrorism Act 2006, which increased the maximum penalty for the section 53 offence to five years in a national security case. The Government will therefore publish for consultation a draft statutory code of practice for the investigation of protected electronic data and the exercise of powers in part 3 of RIPA.

We have previously given an undertaking to bring forward proposals in line with new clause 2 in the context of consulting on the implementation of part 3, and we shall shortly begin those consultations. We remain very sympathetic to what the new clause is designed to do, but we want to allow an opportunity for public consideration and comment on the proposals first, before implementing any legislative changes.

Self-incrimination

Article 6 of the European Convention on Human Rights concerns the right to a fair trial. While not explicitly stated in the convention, the "privilege against self-incrimination [is] generally recognised international standards which lie at the heart of the notion of a fair procedure". However this is not necessarily consistent with UK law in practice, such as the power, under the Road Traffic Act, to require the registered keeper of a vehicle to advise them as to the identity of the driver of that vehicle at a particular time.

The question of self-incrimination was raised in the Lords during the passage of the Regulation of Investigatory Powers Bill.

Lord Bassam of Brighton stated that since the key itself would not self-incriminatory the proposals were ECHR compatible.

In our view, the correct analysis is that a key has an existence independent of the will of the subject. We believe that that was explicitly approved by the European Court in the leading case of Saunders v. United Kingdom in 1996. The court found that the right against self-incrimination does not extend to the use in criminal proceedings of material that may be obtained from the accused for the use of compulsory powers, but which has an existence independent of the will of the suspect; for example, documents recovered under a warrant.

Cases

The annual report of the Office of Surveillance Commissioners contains statistics, supplied by NTAC, on Section 49 Notices. Note that the figures supplied refer to activity within the reported period (April-Mar), e.g. convictions may result from a refusal to comply with notices issued within a previous reporting period.

Period	NTAC approvals	S.49 Notices issued	Refusals to comply	S.53 Convictions
2007/2008	?	(8)	(2)	?
2008/2009	26	15	11	2
2009/2010	38	12	2	1
2010/2011	26	12	2	1
2011/2012	57	20	15	2
2012/2013	35	26	19	3
2013/2014	76	33	17	2
2014/2015	88	37	22	3
2015/2016	87	?	?	?
2016/2017	159	?	?	?

Of the S.49 notices issued and S.53 convictions, only a handful of cases have received media attention.

• 2007-11-03 Animal rights activist (believed to be the first notice) receives a notice for files seized before law in effect.
• 2008-01-16 R v S&A
• 2009-03-07 "JFL" (reported to be the first convicted, June 2009)
• 2010-05: Oliver Drange
• 2011 Thomas Beekmann
• 2012 Lewys Martin
• 2013 Certivox / PrivateSky (S.49 notice implied)
• 2014 Syed Farhan Hussain
• 2014 Lauri Love
• 2014 Christopher Wilson
• 2016 Marvin Jones
• 2018-08 Stephen Nicholson (convicted for not disclosing Facebook password)
• 2019-10 Simon Finch accused of breaching Official Secrets Act "refused to provide access codes" for three devices. Jailed in 2020.
• 2021 Police employee charged, Operation Venetic / EncroChat
• 2021 Craig Whyte charged under s49 for not providing passwords to the FCA

Links

• wikipedia: Key disclosure law
• 2006 presentation by Simon Watkins, Covert Investigations Policy Team, Home Office
• RIP Part III "in an intelligible form", Richard Clayton, 2005
• Security Against Compelled Disclosure, Brown + Laurie
• FIPR RIP centre - FIPR
• Consultation on the Draft Code of Practice for the Investigation of Protected Electronic Information - Part III of the Regulation of Investigatory Powers Act 2000 - Home office web site for the consultation .
• Scrambling for Safety 8: An open meeting on the Home Office access to keys and communications code of practice consultations, 2006
• The economic impact of the regulation of investigatory powers bill An independent report prepared for the British Chambers of Commerce.
• Analyses a variety of bad scenarios by Dr C. H. Lindsey
• spyblog RIPA3 Consultation blog 2006/7
• Disclosure of encryption keys, Decoded:digital 2018-09-04

Media

See /Media