Subject: [Raven] BBC Online 10/2/2000: "Surveillance bill under fire"

From: "Caspar Bowden" <[email-masked]>
Date: Thu, 10 Feb 2000 18:14:33 -0000

http://news.bbc.co.uk/hi/english/sci/tech/newsid_638000/638041.stm
Surveillance bill under fire

At issue is the burden of proof

The UK Government came under fire on Thursday from the internet community
after it published a Bill to regulate covert surveillance.

The critics say the legislation, if passed, could lead to innocent people
being sent to jail simply because they have lost their data encryption
codes.

The Regulation of Investigatory Powers Bill covers the monitoring and the
interception of communications by law enforcement and security agencies. It
will, for example, lay down the legal rules that must be followed by the
police and security services when they tap someone's phone.

It also regulates the authorities' access to the codes that encrypt data
sent over the net. Such encryption will increasingly become a routine tool
of e-commerce, built into ordinary e-mail and browser software. But the Home
Office is deeply concerned that criminals, such as paedophiles, will use
encryption to hide their activities.

And, as a result, the Bill proposes that the police or the security services
should have the power to force someone to hand over decryption keys or the
plain text of specified materials, such as e-mails, and jail those who
refuse.

The government believes it has built sufficient safeguards into the
legislation. But Caspar Bowden, from the Foundation for Information Policy
Research, said the law as drafted was "impossible" and accused the
government of ignoring all the advice and lobbying it had received from the
net community over the past year.

Net privacy

At issue is the burden of proof. Critics of the legislation say someone
might go to jail unless they could prove they did not have a requested key -
an impossible defence for someone who has lost the software code.

"This law could make a criminal out of anyone who uses encryption to protect
their privacy on the internet," Mr Bowden said.

"The Department of Trade and Industry jettisoned decryption powers from its
e-Communications Bill last year because it did not believe that a law which
presumes someone guilty unless they can prove themselves innocent was
compatible with the Human Rights Act.

"But the corpse of a law laid to rest by Trade Secretary Stephen Byers has
been stitched up and jolted back into life by Home Secretary Jack Straw."

Under the new legislation, the police would have to have "reasonable grounds
to believe" someone suspected illegal activity had a key. Previous attempts
to draft the legislation had only used the word "appear".

Human rights

Caspar Bowden acknowledged that the change replaced a subjective test with
one requiring some objective evidence. The prosecution would have to show
that someone receiving encrypted e-mail has or had a key. However, he said
the presumption of guilt remained for those who had genuinely lost or
forgotten their keys.

"It's clear we are heading for the courts with a human rights test case," Mr
Bowden told BBC News Online. "The legislation could be amended, but it's
obvious the government is not going to take that course."

However, the Home Secretary, Jack Straw, is clearly confident about the
legal advice he has received.

"The Human Rights Act and rapid change in technology are the twin drivers of
the new Bill," he said.

"None of the law enforcement activities specified in the Bill is new. Covert
surveillance by police and other law enforcement officers is as old as
policing itself; so too is the use of informants, agents, and undercover
officers.

"What is new is that for the first time the use of these techniques will be
properly regulated by law, and externally supervised, not least to ensure
that law enforcement operations are consistent with the duties imposed on
public authorities by the European Convention on Human Rights and the Human
Rights Act."

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "Richard Payne" <[email-masked]>
Date: Thu, 10 Feb 2000 15:14:48 -0500

Presumably the right to silence, which still exists in the U.K., overrides
the powers supposedly granted to the police by this bill?

Richard Payne

---

From: Matthew Saroff <[email-masked]>
Date: Thu, 10 Feb 2000 14:54:51 -0600

On May 20, 20:15, Richard Payne wrote:
> Subject: Re: [Raven] BBC Online 10/2/2000: "Surveillance bill under fire"
	I believe that that has changed.  Juries are permitted to use someone's
silence against them in the UK.

-- 
Matthew Saroff
Do not reply directly to this message.  Reply to
[email-masked]

---

From: "chefren" <[email-masked]>
Date: Thu, 10 Feb 2000 22:32:43 +0100

> silence against them in the UK.

There are more samples, here in The Netherlands one can be 
imprisoned it the only way to find the truth is by letting 
a specified person speak.

Also tax laws know "reversed proof".

Please remark: This is all about information. Lawmakers 
have had problems with this earlier, now with Internet it 
comes back.

In general: People should always be accountable for what 
they do and say.

+++chefren

---

From: "Caspar Bowden" <[email-masked]>
Date: Fri, 11 Feb 2000 00:59:31 -0000

> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Richard Payne
...
> the powers supposedly granted to the police by this bill?

It's a nice point.

See 49(1).
http://www.publications.parliament.uk/pa/cm199900/cmbills/064/00064--j.htm#4
9

The prosecution must show that the person "has or has had" possession of the
key, but if you are claiming it has been lost or forgotten, naturally that
is conceded. If you do claim it is lost or forgotten (or inaccessible), you
can't just leave it at that, because the burden falls on you to PROVE that
in order to establish your defence.

If nothing at all is said (that can be used in evidence)...I guess they DO
have to show that the person has or has had possession of they key (beyond
reasonable doubt). Interesting - that was not so in the July 99 E-Comms
Bill.

Comments ?
--
Caspar Bowden                    http://www.fipr.org
Director, Foundation for Information Policy Research
Tel: +44(0)171 354 2333      Fax: +44(0)171 827 6534

---

From: Fred Baker <[email-masked]>
Date: Fri, 11 Feb 2000 17:36:00 -0800

>plain text of specified materials, such as e-mails, and jail those who

You might point out RFC 1984 to them.

>public authorities by the European Convention on Human Rights and the Human

This is an important point...

---

From: Ed Stone <[email-masked]>
Date: Fri, 11 Feb 2000 20:58:04 -0500

>This is an important point...

What is the nature and extent of the officers and arrest powers of the 
European Convention on Human Rights, and what is their warrant, search and 
seizure authority in law enforcement agencies in the UK? If the answer is 
"none", then why is this an interesting point?

--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: "Caspar Bowden" <[email-masked]>
Date: Sun, 13 Feb 2000 17:37:16 -0000

Ed Stone said:
> What is the nature and extent of the officers and arrest
> powers of the European Convention on Human Rights, and what is their
> warrant, search and seizure authority in law enforcement agencies in the
UK? If
> the answer is "none", then why is this an interesting point?

I realize there is no reason why the Raven list should know the background
to recent UK encryption/interception policy. In case it helps (and before
we've finished a full analysis of the RIP bill - watch FIPR site), here is
an article which will appear this week in "IT Review" (sent to every British
MP and their researchers), which gives the FIPR view in more detail - it
went to press before publication of RIP, but I haven't seen anything yet to
cause me to revise...

Information Technology Review, Spring 2000

"RIP it up"
===========
Caspar Bowden says that measures contained in the governments
Regulation of Investigatory Powers Bill could wreck confidence in UK
e-commerce

Have you ever lost or forgotten the PIN number of your bank card?
Suppose that the police had the power to demand it - how could you
convince them that you really do not have it? Would it be fair to be
imprisoned if you could not prove that you did not have it?

A PIN is an example of a key which protects access to computer data.
Cryptography - the science of codes and ciphers - is routinely used to
keep credit-card numbers safe in transit to a website, or encrypt
confidential e-mails so only the intended receiver can read them.
Encryption is a basic tool for keeping messages and data secure.

But the need for e-commerce security on the internet has forced radical
changes to a Cold War-era policy. After two years of controversy the
Electronic Communications Bill finally arrived in parliament without
key-escrow - the mandatory requirement to deposit spare keys to all
stored or transmitted data with an officially authorised third party. It
appears that Whitehall had finally heeded warnings that unilateral
controls would drive e-business offshore. But the new regulation of
investigatory powers bill may contain a booby-trap that could still
wreck confidence in British e-commerce.

The Home Office says that merely failing to decrypt data on demand
should not only be a criminal offence, but would carry a presumption of
guilt that the key was being wilfully withheld, with obvious dangers
that innocent persons could be framed or intimidated. The defence must
somehow prove they do not have a key.

How can this be done? Nobody has suggested a convincing solution. A key
may be irreplaceably lost or forgotten, so there is no analogy of
existing laws that require production of a DNA sample or a driving
licence. Even a person not suspected of any crime could go to jail for
two years if they could not decrypt data required. Even more chilling, a
discretionary gagging order could prevent their complaining publicly
with a penalty of five years imprisonment.

But surely an accused person is presumed innocent until proven guilty?
Last year, the Foundation for Information Policy Research published the
detailed legal opinion of two experts on the European Convention on
Human Rights. They said the proposed decryption powers would have the
inevitable consequence of compromising the affected individuals whole
security and privacy apparatus and were likely to contravene Article 8
of the convention on respect for privacy. The opinion also found a
likely violation of Article 6, on the right to a fair trial.

The indications are that the Home Office will disregard this advice and
overwhelming opposition from the industry. Moreover, after taking two
years to abandon its key-escrow policy, the government says it must
now legislate hastily, without further consultation, to comply with the
Human Rights Act's entry into force in October. This richly ironic
excuse is itself questionable - police methods of covert investigation
should already be in compliance today, otherwise a prosecution case
could fail in a trial occurring after October.

The RIP bill will also require ISPs to install costly tapping equipment,
but it will be impossible for them to unscramble messages encrypted by their
customers. Law-enforcement will have to resort to sophisticated bugging
and burgling operations (under warrant), to covertly capture keys.
The Home Secretary personally scrutinises an average of seven tapping
warrants each day, but it is judges or the police who issue search
warrants, and bugging is self-authorised by senior police officers.
Senior judges appointed as Commissioners make spot checks on the bugging
and tapping paperwork, but have no technical staff to query information.
Subjects of surveillance are not informed after an investigation, and
consequently few complaints out of thousands of warrants have ever been
investigated and none upheld. This may be because the law considers
surveillance to be properly authorised, even if based on erroneous
intelligence, provided the information was believed correct at the time.

The efficacy of current safeguards is already dubious, but can they
possibly suffice for the bewildering complexity and entirely new dangers
of Internet surveillance? Powerful data-mining techniques will be used
to analyse data intercepts automatically, and flag suspicious
associations in traffic logs that record the activity of the innocent
and guilty alike. The solution is to replace the Byzantine oversight and
patchwork authorisation of bugging, tapping and secret searches with a
rigorous and consistent system of judicial warrants.

But the Home Office says it has run out of time - time that they
themselves have squandered. It looks as though the statutory framework
for the next fifteen years will have been cobbled together from
unco-ordinated plans drafted in ignorance of the technology.

With the effective dismantling of US export controls, Windows 2000 will
ship with unfettered strong encryption and tens of thousands of ordinary
computer users and professional IT managers will begin to use
encryption. It cannot be long before the first test case challenges
decryption powers under the Human Rights Act.
=======

---

From: "Ge' Weijers" <[email-masked]>
Date: Mon, 14 Feb 2000 07:27:41 -0700

> a specified person speak.

This does not apply to the suspect. The UK proposed laws however
create a Catch-22 situation for the suspect: if you don't want to
incriminate yourself by revealing the key you go to jail for not
revealing your key.

> Also tax laws know "reversed proof".

It's kind of obvious that if you claim a deduction you need to show a
receipt on request. And the law does not speak of "proof", the
standard is set lower, you only have to show that your claims are
reasonable and likely to be correct ("aannemelijk maken").

Ge'