The Regulation of Investigatory Powers Act (RIPA) has
had a clause activated which allows a person to be compelled to
reveal a decryption key. Refusal can earn someone a five-year jail
term.
Part III of RIPA was in the original Act but was not activated.
The Home Office said last year that it had not implemented the
provision because encryption had not been as popular as quickly as
it had predicted. It launched a consultation which culminated in
Part III being made active on 1st October.
The measure has been criticised by civil liberties activists and
security experts who say that the move erodes privacy and could
lead a person to be forced to incriminate themselves.
It is also controversial because a decryption key is often a
long password – something that might be forgotten. An accused
person might pretend to have forgotten the password; or he might
genuinely have forgotten it but struggle to convince a court to
believe him.
Section 49 of Part III of RIPA compels a person, when served
with a notice, to either hand over an encryption key or render the
requested material intelligible by authorities.
Anyone who refuses to decrypt material could face five years in
jail if the investigation relates to terrorism or national
security, or up to two years in jail in other cases.
Controversially, someone who receives a Section 49 notice can be
prevented from telling anyone apart from their lawyer that they
have received such a notice.
The Home Office said that the process will be overseen by the
Interception of Communications Commissioner, the Intelligence
Services Commissioner and the Chief Surveillance Commissioner.
Complaints about demands for information must be made by the
Investigatory Powers Tribunal. "The Tribunal is made up of senior
members of the judiciary and the legal profession and is
independent of the Government. The Tribunal has full powers to
investigate and decide any case within its jurisdiction, which
includes the giving of a notice under section 49 or any disclosure
or use of a key to protected information," said a Home Office
explanation of the process.
The Home Office said that the actions were consistent with the
European Convention on Human Rights and the UK Human Rights Act as
long as the demand for decryption was "both necessary and
proportionate".
"The measures in Part III are intended to ensure that the
ability of public authorities to protect the public and the
effectiveness of their other statutory powers are not undermined by
the use of technologies to protect electronic information," said
the Home Office.
