31 July 2000
From: "Caspar Bowden" <cb@fipr.org>
To: <ukcrypto@maillist.ox.ac.uk>
Subject: Guardian 31/7/2000: "'I arrest you for emailing'"
Date: Mon, 31 Jul 2000 02:04:30 +0100
http://www.guardianunlimited.co.uk/Archive/Article/0,4273,4045916,00.html
Roy Greenslade
Monday July 31, 2000
On Friday the Queen graciously gave her assent to the Regulation of Investigatory Powers bill after it was fast-tracked through parliament with the agreement of the two main parties. So the RIP bill is now the RIP Act, yet another piece of legislation which will prevent journalists from operating freely in the public interest.
On the face of it, the act was proposed for the best of reasons: to ensure that the formidable array of the authorities' investigatory powers accord with human rights. Unless there is good reason, our communications cannot be monitored.
But what amounts to a good reason? Terrorism, drug-dealing, serious crime, tax evasion and that greatest of catch-alls: the national interest. There lies the problem. What the government and its various authorities - whether police, customs and excise or security services - regard as the national interest is all too often about the state's interest rather than the public good.
I'll come back to that. Let's consider the main threat faced by newspapers from the draconian powers of this act. Emails, now the most used form of communication between journalists, and between them and their contacts and sources, are no longer safe.
From this day on, without our knowledge, the authorities can intercept our messages. They will know who said what to whom about what well before the information can be published. Indeed, by having that knowledge in advance they may well be able to take measures to prevent its publication.
This isn't far-fetched. A good example occurred recently when the renegade MI5 officer David Shayler emailed the Observer and the Guardian. When the police - claiming to be acting in the national interest - tried to compel the papers to hand over the emails, the request was refused.
A judge ordered the papers to comply, a ruling that was overturned by the court of appeal in a masterly judgment by Lord Justice Judge which stressed the rights of a free press to investigate matters on behalf of the public without compromising its informants.
If the RIP Act had been on the statute book at the time, that case would never have reached court because the police would have used the act's powers to obtain the emails secretly regardless of such rights.
It wouldn't have helped if the emails had been encrypted. Under the new act, the authorities can demand the key to any encrypted message.
In other words, the RIP Act makes all traffic over the internet in Britain available to the state if a body, however flimsy its suspicion, decides to apply for the right to intercept emails.
Nor will the authorities need a legal warrant to do so. Interception will require only the home secretary's approval while the monitoring of traffic can be "self-authorised" by whoever decides it is necessary. Demands for someone to provide an encryption key can be authorised by a customs and excise official, a chief constable, a magistrate, a judge or the home secretary.
The passing of the RIP Act denies everyone the freedom, and the privacy, we thought the internet had provided. It robs journalists and their sources - including that most potent and essential of tipsters, the whistle-blower - of their rights and, quite possibly, threatens their liberty.
Despite significant concessions made during the passage of the bill, it is still badly conceived and may well prove counter-productive. Internet experts believe that users will soon employ a range of esoteric "privacy tools", enabling them to camouflage emails and hide files, to avoid compliance.
In what appears to have been panic at the growth of the internet and the freedom enjoyed by its users, the British government has accorded itself powers which no other western country has dared to take.
Yet this, remember, is the government that came to power crowing about its commitment to end secrecy.
Instead its record has been a disgrace. Jack Straw last week finally announced that the Home Office will consult media bodies to ensure that future legislation which does "impact on press and media reporting" does not create "unintended restrictions".
What a cheek. The sound of the stable door being closed long after the horses have bolted is deafening. So far we have seen a milksop freedom of information proposal, a worrying data protection act, a thoughtless youth and criminal evidence act, a potentially harmful terrorism act and a restrictive local government act.
Now comes the RIP Act. Consultation is supposed to happen before, Mr Straw, not afterwards.
The Regulation of Investigatory Powers Act (RIP)
What is it? Originated by Jack Straw, RIP sets out the government's plans to allow official surveillance of internet traffic. Published in February 2000, it passed through the Lords in July and becomes law in October.
The government line? RIP gives police and security services new powers to monitor and intercept emails and websites, channels through which online criminals, terrorists, paedophiles and pornographers have traditionally been able to communicate.
Some data on computers, such as child pornography, is often encrypted. The bill makes it illegal to refuse a police request to decrypt data.
All security service warrants for data interception will require prior government approval, bringing the UK into line with other EU surveillance measures.
The anti-government line? The cost and maintenance of necessary surveillance equipment will be passed on to the internet user, threatening e-commerce in Britain and billions in lost business.
Every UK internet service provider will be responsible for the installation of remote-controlled black boxes relaying all data passing through its computers to a special monitoring centre in MI5's HQ, the Government Technical Assistance Centre.
Unlike telephone tapping, which can be specified, RIP allows the government to monitor all UK internet traffic - sites downloaded, address books, emails, discussion groups and chat rooms - without a warrant, which could be considered a contravention of the privacy requirements of the European convention on human rights. There are two-year sentences for forgetting passwords, and for failing to surrender or losing keys used to encrypt communications data. The burden of proof is reversed from the prosecution to the defence.
Then there are five-year sentences for telling anyone that you have been served with an order to surrender encryption keys or hand over encrypted material in "plaintext" form. The RIP bill can justifiably be called a total infringement of civil liberties. From October, no one in the UK will be able to feel free from government surveillance.
International precedents? Only Russia, Singapore and Malaysia have similar laws. There is nothing comparable in the US. A recent Irish law makes it illegal for government to access commercial encryption keys. France has relaxed controls on domestic encryption, while Germany is opposed to restrictions on citizens' use of encryption.