By John Leyden for The Register. This
story was reproduced with permission.
Section Three of the Regulation of Investigatory Powers Act
(RIPA) came into force at the start in October 2007, seven years
after the original legislation passed through parliament. Intended
primarily to deal with terror suspects, it allows police to demand
encryption keys or provide a clear text transcript of encrypted
text.
Failure to comply can result in up to two years imprisonment for
cases not involving national security, or five years for terrorism
offences and the like. Orders can be made to turn over data months
or even years old.
The contentious measure,
introduced after years of consultation, was sold to Parliament
as a necessary tool for law enforcement in the fight against
organised crime and terrorism.
But an animal rights activist is one of the first people at the
receiving end of a notice to give up encryption keys. Her computer
was seized by police in May, and she has been given 12 days to hand
over a pass-phrase to unlock encrypted data held on the drive - or
face the consequences.
The woman, who claims to have not used encryption, relates her
experiences in an anonymous posting on
Indymedia.
"Now apparently they have found some encrypted files on my
computer (which was stolen by police thugs in May this year) which
they think they have 'reasonable suspicion' to pry into using the
excuse of 'preventing or detecting a crime'," she writes.
"Now I have been 'invited' (how nice, will there be tea and
biccies?) to reveal my keys to the police so they can look at these
files. If I do not comply and tell them to keep their great big
hooters out of my private affairs I could be charged under
RIPA."
The woman says that any encrypted data put on the PC must have
been put there by somebody else.
"Funny thing is PGP and I never got on together I confess that I
am far too dense for such a complex (well to me anyway) programme.
Therefore in a so-called democracy I am being threatened with
prison simply because I cannot access encrypted files on my
computer."
She argues that even if she had used encryption she'd be
disinclined to hand over her pass phrase. "The police are my enemy,
I know that they have given information about me to Huntingdon Life
Sciences (as well as hospitalising me)," she writes. "Would I
really want them to see and then pass around private communications
with my solicitors which could be used against me at a later date
in the civil courts, medical records, embarrassing poetry which was
never meant to be read by anyone else, soppy love letters or indeed
personal financial transactions?"
Indymedia reports that similar demands have been served against
other animal rights activists, a point we have not been able to
verify.
The woman was issued a notice by the Crown Prosecution Service,
and not (as might be expected) the police. According to the
code of conduct, the authorities would normally ask a suspect
to put the files into intelligible form, though how this would work
when a PC is being held by the police is far from clear.
It's unclear if the woman was given an official Section 49
notice or simply "invited" to hand over the data voluntarily as
part of a bluff by the authorities.
Richard Clayton, a security researcher at Cambridge University
and long-time contributor to UK security policy working groups,
said that only the police are authorised to issue Section 49
notices. "What seems to have happened is that the CPS (who couldn't
issue a notice anyway) have written asking the person to volunteer
their key," he adds.
"Should they refuse this polite request, they are being
threatened with the subsequent issuing of a notice, which might or
might not require the key to be produced (it might of course just
require the putting into an intelligible form of the data)."
Clayton expressed concern that the incident illustrates possible
holes in the long-delayed code of practice. "It would clearly be
desirable to seek
NTAC's views before approaching suspects with requests for keys
(rather than requests to put into an intelligible form) - lest the
authorities give the impression that they know rather less about
the rules (and the operation of encryption systems) than everyone
else," he said.
© The Register
2007
