Human rights challenge to RIPA
OUT-LAW Radio, 24/01/2008
We investigate whether or not a new law compelling UK citizens
to hand over encryption keys on pain of being jailed might strip
them of their right to a fair trial.
A text transcription follows.
This transcript is for anyone with a hearing impairment or who
for any other reason cannot listen to the MP3 audio file.
The following is the text spoken by OUT-LAW journalist Matthew
Magee.
Hello and welcome to OUT-LAW Radio, the weekly podcast that
keeps you up to date on all the twists and turns in the world of
technology law.
Every week we bring you the latest news and in depth features
that help you to make sense of the ever-changing laws that govern
technology today.
My name is Matthew Magee, and this week we look at
recently-granted police powers to force you to give up your
computer password and ask: is it vulnerable to a challenge under
human rights law?
But first, the news:
- Football clubs' copyright case faces competition challenge;
and
- Google accuses Europe of sleight of hand
The right of football clubs to carve up foreign markets for
broadcasting matches will be challenged at a full trial after the
clubs failed to win a snap judgment against a firm selling Greek
decoder cards to UK pubs so they could show live English
football.
The Football Association Premier League (FAPL) accused QC
Leisure and AV Station of breaching copyright law by selling
equipment to show games.
But the companies said that attempts to stop them selling cards
are in breach of the EC Treaty, which lays out the founding
principles of the European Union and guarantees the right of free
trade between member states.
The clash between copyright and competition law is an old one
according to Kim Walker an intellectual property law specialist
with Pinsent Masons, the law firm behind OUT-LAW.
"There has always been a tension between IP rights and
competition law because IP gives exclusive rights to do certain
things in certain places but competition law doesn't like the
concept of exclusivity," he said.
Google has accused European Union authorities of attempting to
use antitrust laws to tackle privacy issues. The company was
defending its proposed acquisition of online advertising company
DoubleClick.
The takeover has already been cleared by US consumer regulator
the Federal Trade Commission but awaits approval from the European
Commission, which is responsible for competition regulation in
Europe. Though Google said that the Parliamentary hearing made an
association between privacy and competition, the Commission itself
has not yet mentioned such a link.
A European Parliament hearing into privacy on the internet
discussed the proposed takeover. But Google's chief privacy counsel
Peter Fleischer said "People are trying to take a privacy case and
shoehorn it into a competition law review".
Dutch MEP Sophie in 'tVeld, who was behind the hearing, said
that the acquisition of information was what made companies such as
Google powerful, and what made privacy issues a factor in a
competition inquiry.
That was this week's OUT-LAW news
The police have long had the power to search your emails and
computer files and intercept your communications. But last autumn
their powers were increased when the law was changed to allow them
to demand that suspects hand over any passwords to unlock
information that has been encrypted.
This was a major new development to which civil liberties
activists fiercely objected. They said it eroded privacy and opened
people up even further to possible abuse of process by
authorities.
The new law has barely been tested, with only unconfirmed
reports emerging of its use but could it be that anyone faced with
such a demand could use other legislation to defend themselves? Is
the new power at odds with existing law?
Some people think so. There is a long established tradition that
prevents people from incriminating themselves or being forced to
testify against themselves. Is being threatened with jail unless
you tell police your password self-incrimination?
We'll hear from one criminal law specialist who thinks it could be,
but first William Malcolm of Pinsent Masons, the law firm behind
OUT-LAW, explains what last year's change to the Regulation of
Investigatory Powers Act, or RIPA, means.
Malcolm: Part 3 of the Regulation of
Investigatory Powers Act provides a statutory framework that
enables public authorities to require protected or electronic
information which they have obtained lawfully to be put into an
intelligible form and in effect failure to comply with a lawfully
issued order could land you two years in jail or five years in jail
if the case involved national security considerations.
There could be a problem, though. if you are arrested you are
told you have a right to remain silent under questioning. The Human
Rights Act, which is based on the European Convention on Human
Rights, gives you a right to a fair trial, and European courts have
read this as meaning that you can't be forced to incriminate
yourself.
Jonathan Rogers is a lecturer in law at UCL in London where he
specialises in criminal law. He first explained why courts don't
like to force people to give evidence against themselves.
Rogers: The normal principles of the right to
silence is that nobody commits any criminal offence by refusing to
talk to the police but a general principle on the statute makes
particular exceptions and as we shall see a statute has made an
exception in the case of not giving the key to encrypted data but
the ordinary situation is that a person does no wrong by refusing
to talk to the police and it is simply thought to be part of a
civilised society that a man cannot be forced to incriminate
himself as a matter of cruel choices I suppose. We don't think of
it as being quite the same as torturing somebody but we nonetheless
think it is not so very different if a man is told that he will
commit one offence if he does not cooperate in giving material
which will make him guilty of another.
We asked the Crown Prosecution Service what would happen if
someone attempted to defend themselves against handing over a
password by invoking the right to silence. It said that the new
section of RIPA effectively trumps any right to silence.
"There is no absolute right to remain silent, not even in human
rights law," a spokeswoman said. "It must be proportionate and
necessary. Someone could try arguing it, but it is unlikely to be
successful."
So what rights do we have? Article 6 of the Human Rights Act
contains a right to a fair trial. This is where limited protection
comes from, said Rogers.
Rogers: Article 6 provides us all a right to a
fair trial both in civil and criminal proceedings. It gives various
rights such as the right to a lawyer, the right to be able to
understand the language, the right to be able to examine the
witnesses against you. Oddly enough in the text of Article 6 there
isn't actually any words addressing the principle of self
incrimination but the European Court read in those words of the
text many years ago which of course gives them more flexibility in
interpreting them.
Just last year the issue was tested at the European Court of
Justice. A British driver, a Mr O'Halloran, was served with a
speeding ticket from a police camera, but he refused to tell police
who was driving the car at the time. He took his case all the way
to the ECJ, which said that he should be forced to tell.
Rogers said that the court applied very specific tests, which would
be used in other cases.
Rogers: So the question is when is it
allowable? They said that this would depend on each case, on the
nature of the compulsion put upon the defendant, the number of
safeguards which exist and the use to which the information might
be put. Obviously if you're forced to cooperate with the police on
pain of being punished for a criminal offence, then that is pretty
direct compulsion, so that in principle is bad but that's not the
only factor. It's also relevant to consider whether there are any
safeguards in the system so if the defendant really doesn't have
the information then it's important to know whether or not he could
still be penalised for not giving it. Other safeguards would also
include whether the investigation is being authorised at a senior
level and whether there is already some evidence against the
defendant in the first place. Obviously the more evidence against
the defendant the more reasonable it is to expect him to cooperate
with the inquiry. And it's also relevant to consider to what use
the information will be put.
So how would these apply in the case of the handing over of a
password? Rogers emphasises that we can't know until it is tested,
that the traffic offence case of O'Halloran can't be much of a
guide to a major criminal investigation.
He said that a court may well decide that there is a conflict with
the Human Rights Act, but that the fact that police need to have
made some progress before demanding your key may work in favour of
their demands.
Rogers: It's not as if the police can require
the information to be given at the beginning of the investigation.
They can only do so when they've made certain progress. So it might
be that we would say to ourselves the requirement is actually
proportionate and not a violation of Article 6 in which case we can
just apply the statute as usual.
These very questions are facing a legal test in the US, where
the constitution's fifth amendment grants an absolute right to
avoid self-incrimination. There, a man is fighting a court battle
to use that right to deny police the key to an encrypted drive that
they suspect contains images of child abuse.
No such absolute protections against self incrimination exist
here, and Human Rights law lecturer Colm O'Cinneide, also of UCL,
says that while there is no reason why police shouldn't be allowed
to search encrypted drives under a court warrant - just as they can
unencrypted ones - the new section of RIPA can be seen as part of a
creeping erosion of civil liberties in the UK.
O'Cinneide: I think the issue is here though,
it certainly raises lingering concerns. There is certainly unease
in general about the gradual erosion of our privacy and the opening
up of closed spaces to government surveillance. The difficulty can
be as a lawyer working this area is that the law doesn't
necessarily provide very strong protection in this area and
government investigating authorities and the police are amassing an
awful lot of power. Usually on an issue by issue basis it all seems
quite common sensical, it makes sense but what you're ending up
with at the end of the day to a sort of incremental assessment of
surveillance powers, you're ending up at the end of the day with
very broad government surveillance powers.
Malcolm from Pinsent Masons, though, believes that RIPA itself
offers people adequate protection of their rights.
Malcolm: Well I think it's important to bear in
mind the public authorities who exercise powers to access this type
of material under RIPA need to exercise their powers
proportionately and consistently with their duties under Human
Rights legislation and it's also worth bearing in mind that the
whole purpose of the Regulation of Investigatory Powers framework
is to place on a statutory footing, on a transparent footing, the
way in which law enforcement agencies and national security
agencies access these materials. Why? Well simply because by having
that level of transparency we can ensure the protection of people's
rights. So the Act itself is designed to ensure the protection of
human rights and public authorities have a duty to exercise these
powers proportionately.
Magee: That's all we have time for this week,
thanks for listening.
Why not get in touch with OUT-LAW Radio? Do you know of a
technology law story? We'd love to hear from you on radio@out-law.com. Be sure to tune
in next week, for now goodbye.
OUT-LAW Radio was produced and presented by Matthew Magee for
international law firm Pinsent Masons.
