17 July 2000
From: "Caspar Bowden" <cb@fipr.org>
To: <cb@fipr.org>
Subject: WSJ 17/7/2000: "U.K. Internet Tapping Bill Stays Intact"
Date: Mon, 17 Jul 2000 11:33:05 +0100
http://networking.wsj.com/SB963773445102605724-SB963773445102605724.html
By MARC CHAMPION
Staff Reporter of THE WALL STREET JOURNAL
LONDON -- The final shape of Britain's controversial Internet tapping bill is becoming clear after it emerged bruised but intact from scrutiny in Parliament's upper house.
The so-called RIP bill -- for regulation of investigatory powers -- has stirred controversy because it would make Britain the only country in the Group of Seven industrial nations with the explicit legal power to demand that companies hand over keys required to decode data encrypted for secrecy.
It would also give the government new powers to attach software to Internet-service providers that could pipe data, under warrant, to a unit housed in the building of MI5, Britain's internal security service.
Failing a change of heart on the part of the government, the bill is likely to be voted through the upper house of Parliament on Wednesday. It then returns to the lower house, which is expected to approve it if the government accepts the amended text.
After last week's debate in the upper house, the bill has been significantly amended, with some of the most controversial clauses removed. Opponents, however, continue to warn that Britain could gain a reputation as a police state of the Internet world. This, they say, could drive companies to store sensitive data offshore, prompt Internet-service providers to move or route traffic abroad, and cost the country billions of pounds in lost investment.
"None of the changes alter the fact that Britain would become the only G-7 economy with government access to keys, and if you were a business, why would you locate here knowing that?" said Caspar Bowden of the Foundation for Information Policy Research (www.fipr.org).
Changes to the Bill
One important change has been to require the government to pay a "fair" share of the cost of installing the so-called black boxes that would transmit data from the ISPs to the MI5 building -- estimated at anywhere from 20 million pounds to 640 million pounds ($30 million to $960 million). The upper house also stipulated the establishment of an independent body that includes industry representatives to arbitrate the government's dealings with the ISPs.
Much of the language surrounding the granting of warrants has also been tightened up, while a definition of "communication data" -- Internet traffic logs -- that police can monitor without a warrant has been redefined to prevent unauthorized trawling for content. The rank of official required to approve a request for encryption keys has also been raised, to police chief constable or equivalent.
Another change means that those accused of deliberately "forgetting" an encryption key to avoid handing it over would no longer be obliged to prove that they forgot. Human-rights groups had decried that clause as a reversal of the traditional presumption of innocence. Prosecutors must now prove that the accused "knowingly" failed to comply.
Other amendments, however, failed. For example, the criteria for getting a warrant are to protect national security, to safeguard economic well being or to prevent or detect serious crime. The upper house tried to have the definition of serious crime narrowed so it wouldn't include "large numbers of persons in pursuit of a common purpose." That could include any number of organizations that might irritate the government but don't qualify as terrorists. This, however, was in a package of proposed amendments defeated by one vote.
The Big Picture
Largely forgotten in the furor over RIP is that the bill covers far more than the Internet and that much of it is required to comply with European Union laws on human rights. The bill codifies Britain's existing morass of regulations governing all interception (of telephone calls, mail and Internet traffic), as well as traditional surveillance.
"In some areas it actually puts tighter restrictions on what the government can do," said Marie Colvin, a lawyer advising the London-based human-rights group Justice. "They really needed to do this -- it's good!"
Some of the public horror has been caused by the highlighting of practices already common around the world. The British authorities, for example, have always been entitled to intercept e-mail under warrant. And the U.S. government already attaches software to ISPs when it wants to pipe data for monitoring.
But by making explicit legal provision for Internet tapping, the British government has aroused fears for privacy that will be hard to assuage. Mr. Bowden believes the RIP bill's approach is inappropriate for a technology as fluid as the Internet.
"We got them to change the definition of communications data, which is good," Mr. Bowden said, referring to the traffic logs the government could monitor without a warrant. "But the next generation of mobile telephones will let a phone company pinpoint exactly where you are so long as the phone is switched on. Under the RIP bill that data -- tracking everywhere you have been -- would be available to the police without a warrant."
Watching the Web
Key terms of Britain's e-snooping bill