Teen jailed over failure to hand over computer password

Oliver Drage, 19, was found guilty of an offence under the Regulation of Investigatory Powers Act (RIPA) by a jury at Preston Crown Court last month. He has now been sentenced to 16 weeks in a young offenders institution.

Part III of RIPA came into force in October 2007, seven years after the original legislation passed through parliament. It compels a person, when served with a notice, to either hand over an encryption key or to make requested material intelligible to authorities. Anyone who refuses can face up to five years in prison if the investigation relates to terrorism or national security, or up to two years in prison in other cases.
 
Drage was arrested as part of Lancashire Constabulary's Awaken investigation into child sexual exploitation in May 2009. The Constabulary said that it seized but that police officers could not access material on it because it was protected by encryption, which could only be decoded using a 50 character password.

The police said that it was essential that they have access to seized material.

"Computer systems are constantly advancing and the legislation used here was specifically brought in to deal with those who are using the internet to commit crime," said Detective Sergeant Neil Fowler of Blackpool Police. "[The sentence] sends a robust message out to those intent on trying to mask their on-line criminal activities that they will be taken before the courts with the ultimate sanction, as in this case, being a custodial sentence."

The report of the Chief Surveillance Commissioner for 2008 to 2009 said that two people had been convicted in that period for not providing keys to information to police, said a Government answer to a Parliamentary question in 2009.

The legal demand that a person hand over a decryption key caused some concern amongst civil liberties activists. UCL law lecturer Jonathan Rogers told OUT-LAW Radio in 2008 that the legal power could conflict with the right of accused people not to self-incriminate, but that a system could protect accused people with the right safeguards.

"It's ... relevant to consider whether there are any safeguards in the system so if the defendant really doesn't have the information then it's important to know whether or not he could still be penalised for not giving it," said Rogers. "Other safeguards would also include whether the investigation is being authorised at a senior level and whether there is already some evidence against the defendant in the first place."

"Obviously the more evidence against the defendant the more reasonable it is to expect him to cooperate with the inquiry. And it's also relevant to consider to what use the information will be put," he said.