Lauri Love and the potential civil law “backdoor” for obtaining encryption keys

10th May 2016

This is an “explainer” post about a potentially significant court decision being handed down today on whether the UK State can use civil law as a legal “backdoor” for obtaining encryption keys.

The case:  Lauri Love v National Crime Agency

The venue: Westminster Magistrates’ Court, from 1000 hrs today

The claim: An application under section 1 of the Police (Property) Act 1897 for recovery of computer equipment seized by the National Crime Agency – note this is an example of a civil matter being dealt with by a Magistrates’ Court.

The procedural stage: The application is still pre-trial, and the overall application is set down for a trial hearing on 28 July 2016.

Today’s decision: Today the presiding judge District Judge Tempia will make a decision on whether Lauri Love be “directed” at this stage to provide an encryption key as part of the civil claim, and before the trial.

This is because the National Crime Agency, the “defendant” in this claim, is insisting that the key be handed over before the application be tried and a decision made to return the equipment.

Why this matters: The statutory regime for requests for encryption keys (and encrypted data) is under Part III of the Regulation of Investigatory Powers Act 2000 (RIPA).

The state agency – in this case the National Crime Agency – would serve a “section 49” notice, and if a valid section 49 notice is not complied with, then the recipient of the notice can face prosecution under section 53.

The recipient, however, has the protections of the safeguards of section 55 and the protections of the detailed (fifty-odd page) Code of Practice.

By requesting a direction as part of the civil application, the National Crime Agency is seeking to sidestep the RIPA scheme and effectively circumvent the section 55 safeguards and the protections of the Code of Practice.

The extradition context: Lauri Love is facing extradition to the United States.  The United States indictments are at Lauri Love’s website.  The extradition application is also being heard by Westminster Magistrates’ Court, but those are separate and distinct legal proceedings.

This civil claim is self-contained and is not directly relevant to the extradition.

The earlier section 49 notice: Lauri Love has also been already served with a section 49 notice, in February 2014, and did not provide the requested information.   The National Crime Agency did not continue with the RIPA process.

Comment:

Many of the coercive and intrusive powers given to the state under RIPA are balanced by safeguards and protections against abuse of those powers.

The powers and the checks on them should be seen as a package.

By seeking to use directions in a civil claim to achieve the same aim, where the safeguards and protections against abuse will not apply (and which would be decided on a lower standard of proof – section 53 has the criminal standard, whilst a direction in a civil case would (of course) have the civil standard) then the National Crime Agency are departing from what RIPA intended.

If the National Crime Agency want the encryption key then they should follow the RIPA statutory scheme and not try to get round it.

Instead, the National Crime Agency are asking the courts to construct an civil law “backdoor” for obtaining encryption keys (and encrypted data) outside the statutory scheme of RIPA.

Further reading:

The Intercept

The Register

BBC

*

header banner image

Regular independent blogging at Jack of Kent is made possible by the kind sponsorship of Hammicks Legal Information Services.  Please click on this link to Hammicks and have a browse.

For email alerts for my posts at Jack of Kent, the FT and elsewhere, please submit your email address in the “Subscribe” box on this page.

Where is the Tort? Something seems to be missing in the Investigatory Powers Bill

2nd March 2016

Here is an interesting omission from the Investigatory Powers Bill published yesterday.

The current legislation – the Regulation of Investigatory Powers Act 2000 – provides, at section 1(3), a tort for unlawful interference (emphasis added):

Any interception of a communication which is carried out at any place in the United Kingdom by, or with the express or implied consent of, a person having the right to control the operation or the use of a private telecommunication system shall be actionable at the suit or instance of the sender or recipient, or intended recipient, of the communication if it is without lawful authority and is either—

(a) an interception of that communication in the course of its transmission by means of that private system; or

(b) an interception of that communication in the course of its transmission, by means of a public telecommunication system, to or from apparatus comprised in that private telecommunication system

This provision means a person can sue another person for unlawful interception, rather than just rely on the government to prosecute.  It was, in this way, a directly enforceable privacy right.  (It was a tort used, I understand, in phone and computer hacking claims.)

But the Bill does not (seem to) have this tortuous protection for individuals, even though Part 1 of the Bill is supposedly protecting privacy. (If it somewhere else in the vast Bill, I cannot find it.  Please correct me if I am wrong.)

If this is correct, and the tort is being repealed, then why is the government removing this civil law right, leaving the individual only with criminal law protection under what will be the new Act – which in turn needs the prior consent of the Director of Public Prosecutions?

I have just noticed the omission (it was also missing from the earlier draft Bill). There may be a good explanation. Let’s see.  I have asked the Home Office if they can tell us.

But there is no point adding “Privacy” to the title of Part 1 of the Bill if the government is also taking the directly enforceable tort from the statute book.

header banner image

Regular blogging at Jack of Kent is made possible by the kind sponsorship of Hammicks Legal Information Services.  

If you value this blog and its free content, please do click on this link to Hammicks and have a browse.

Please subscribe to this Blog. To get alerts for my new posts at Jack of Kent and the FT, and anywhere else, please submit your email address in the “Subscribe” box at the top of this page.

“Privacy is Surveillance” – Part 1 of the Investigatory Powers Bill

2nd March 2016

Yesterday the government put the Investigatory Powers Bill before parliament.

(Note it is not a “draft” Bill – that was the last one. This is now the Bill (which is, in turn, a draft Act).)

The parliament webpage for the Bill is here and it is worth bookmarking, as website will track the passage of the Bill and will provide links to the debates and other materials.

The Bill itself is here  and the “explanatory notes” are here.  (The explanatory notes are to explain the Bill – but they are not part of the Bill, will not become law, and will not bind any court.)

It is a long and complex Bill – many of the clauses are highly technical even before you try and fit the clauses together. (In this way, writing legislation or any other complicated legal document is lot like coding.)

It looks like government is seeking to rush the Bill through at speed.  Of course, such disregard for parliament is contrary to this government’s lofty assertions about “parliamentary sovereignty”.  There is a serious question as whether parliament can properly scrutinise the Bill.

In this post, I do not even try to scrutinise the Bill.  I am going to do something far more trivial but which may (or may not) show something telling about the Bill.

You will see that “Part 1” of the Bill is called “General Privacy Provisions”.

PrivacyIsSurveillance

From a liberal perspective, this is an encouraging signal.

A search for “privacy” in the Bill, however, reveals that other than in clause 1(3)(a) – in the image above – there are no mentions of “privacy” anywhere else in the Bill, other than in titles.

Of the fourteen mentions of “privacy” overall:

one is the title of Part 1;

one is the title of Part 1 in the contents page;

nine are mentions of the title of Part 1 in the headers;

one is at clause 1(3)(a); and

two are in mentions of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426).

So “privacy” is mentioned more often in the headers to pages than in the Bill itself, and it is only once used anywhere in the Bill when it is not in a title.

It is almost as if some bright spark at the Home Office thought that privacy concerns could be addressed by simply adding “privacy” to the title of Part 1 of the Bill.

Of course, this is not a complete way of assessing how privacy is addressed in the Bill – privacy points can be covered without necessarily using the word, and a search for “privacy” in the (non-binding) explanatory notes is an instructive exercise.

But, as far as Part 1 of the Bill is concerned, the motto could well be “Privacy is Surveillance” – as one famous political observer would have put it.

_____________________________________

Regular blogging at Jack of Kent is made possible by the kind sponsorship of Hammicks Legal Information Services.  

If you value this blog and its content, please do click on the links to Hammicks and have a browse.

To get alerts for my new posts at Jack of Kent and the FT, and anywhere else, please submit your email address in the “Subscribe” box at the top of this page.

 

The push-me-pull-yous of public policy: surveillance and freedom of information

1st March 2016

*

“If you have nothing to hide then you have nothing to fear.”

Adage, attributable to someone or other.

*

Surveillance and freedom of information are the push-me-pull-yous of public policy.

Those politicians and officials in favour of ever-more surveillance will assure you that if you have nothing to hide then you have nothing to fear.

But many politicians and officials – often the same ones urging greater powers of surveillance – want to weaken the freedom of information rights of the citizen against public bodies.  It would seem politicians and officials need the “safe spaces” which they also wish to deny the citizen.

Of course, this is a contradiction: the politicians and officials cannot – at least not intellectually – have it both ways.

At base the debates about surveillance and freedom of information are about the relationship of the citizen and the “state” – who knows what about whom.  And if politicians and officials want to know more about the citizens, then the same principle of transparency should first be applied to public activities.

After all, if politicians and officials have nothing to hide then they surely have nothing to fear.

header banner image

_____________________________________

Regular blogging at Jack of Kent is made possible by the kind sponsorship of Hammicks Legal Information Services.  

If you value this blog and its content, please do click on the links to Hammicks and have a browse.

To get alerts for my new posts at Jack of Kent and the FT, and anywhere else, please submit your email address in the “Subscribe” box at the top of this page.

Law and policy round-up: Do Ministers know best?

10th February 2016

This is today’s law and policy round-up.

*

Ministers really do know best, it would seem.

A couple of days ago the Attorney-General – whose office is still narked at losing the Evans and Prince of Wales letter case [2015] UKSC 21 – gave a speech where he explained why ministers were better guardians of the public interest than judges.

And yesterday at a parliamentary committee, Justice Minister Shailesh Vara responded defiantly to powerful recent criticism by the Master of the Rolls on the shoddy MoJ research into the effect of court fees.

But meanwhile, back in the real world, the Intelligence and Security Select Committee published a scathing report on how Ministers did not have any clue why they were asking for the surveillance powers in the new Investigatory Powers Bill.

It would appear Ministers do not know best, after all.

*

_____________________________________

To get alerts for my new posts at Jack of Kent and the FT, and anywhere else, please submit your email address in the “Subscribe” box at the top of this page.