The Regulation of Investigatory Powers Bill is expected to become
law in October. The Bill gives police the power to demand keys to
encrypted data and anyone failing to comply risks jail. Critics say
this means a person could be guilty until proven innocent.
This Bill has caused much controversy in the UK. Among other
matters, the Bill addresses the rights of authorities, such as the
police and intelligence services, to require a computer user to
hand over decryption codes used by him or her (for more information
on encryption, see the link below). Failure to comply with such a
demand could lead to the individual being jailed. This is the most
contentious part of the Bill.
Where, for example, encrypted information has come into the
hands of the police by legal means, if the police have reasonable
grounds to believe that a decryption key is in the possession of
any person and the police believe that obtaining the key is
necessary for preventing or detecting crime, the police can demand
the disclosure of the key. The person required to disclose the key
can submit a decrypted version of the information, instead of the
key itself. However, it is possible that the key itself will be
demanded if the decrypted information is deemed insufficient. The
previous proposal was to demand that keys be placed in the hands of
a trusted third party.
Failure to comply with a demand for a key can be a criminal
offence. Human rights activists claim this is a reversal of the
burden of proof – that anyone faced with such a demand might have
simply lost the key or might never have had possession of it, yet
such a person will be guilty until proven innocent. The penalty for
this offence is a maximum of two years imprisonment and/or a
fine.
The Home Office has pointed out that, under the Bill, the
prosecution would have to prove that the individual did have a key
in the first place. They argue that the Bill is necessary to comply
with the UK’s obligations under the European Convention on Human
Rights.
The Bill also makes reference to the monitoring of electronic
communications. The organisations in a position to do so are the
ISPs – and they are concerned about the costs involved in doing so.
Demon has estimated that effective interception technology would
cost them 1 million pounds a year. It has yet to be confirmed
whether the Home Office will meet this expense.
Although the RIP Bill is intended to apply UK wide, the Scottish
parliament has suggested the introduction of an intrusive
surveillance bill by Summer 2000. Although details of it have yet
to be announced, it will deal with some of the matters in the RIP
Bill differently in Scotland.
