Talk:Regulation of Investigatory Powers Act 2000

The Nature of the RIP Act

Just referenced this to check for a commencement date and was appalled at the article - it's not factually accurate. Start with "At the passing of the act only nine organisations (including the police and security services) were allowed to invoke it, but as of 2008, it was 792 organizations (including 474 councils).[1]"

The original Act names all these :

1 Any police force.

2 The National Criminal Intelligence Service.

3 The National Crime Squad.

4 The Serious Fraud Office.

The intelligence services

5 Any of the intelligence services.

The armed forces

6 Any of Her Majesty’s forces.

The revenue departments

7 The Commissioners of Customs and Excise.

8 The Commissioners of Inland Revenue.

Government departments

9 The Ministry of Agriculture, Fisheries and Food.

10 The Ministry of Defence.

11 The Department of the Environment, Transport and the Regions.

12 The Department of Health.

13 The Home Office.

14 The Department of Social Security.

15 The Department of Trade and Industry.

The National Assembly for Wales

16 The National Assembly for Wales.

Local authorities

17 Any local authority (within the meaning of section 1 of the [1999 c. 27.] Local Government Act 1999).

Other bodies

18 The Environment Agency.

19 The Financial Services Authority.

20 The Food Standards Agency.

21 The Intervention Board for Agricultural Produce.

22 The Personal Investment Authority.

23 The Post Office.

Part II Relevant authorities for the purposes only of s. 28

The Health and Safety Executive

24 The Health and Safety Executive.

NHS bodies in England and Wales

25 A Health Authority established under section 8 of the [1977 c. 49.] National Health Service Act 1977.

26 A Special Health Authority established under section 11 of the [1977 c. 49.] National Health Service Act 1977.

27 A National Heath Service trust established under section 5 of the [1990 c. 19.] National Health Service and Community Care Act 1990.

The Royal Pharmaceutical Society of Great Britain

28 The Royal Pharmaceutical Society of Great Britain.

I propose to make a full scale rewrite to this, unless someone 'in authority' suggests otherwise. (FYI - I work in the UK teaching investigation law, so I know that of which I speak!!)Tattooed Librarian (talk) 14:33, 6 May 2009 (UTC)

This article is rather cryptic on the nature of the burden placed on ISPs, and it's civil liberties implications. As I understand it the ISPs are required to maintain a database of all internet access by all their clients: so every web page requested, email sent, etc, has it's header information (but not the full content) recorded by the ISP, to be made available to various agencies on request (originally only with a warrant I believe, but that may have been weakened; they certainly wanted to open it up to a much wider group of agencies). The data thus collected was to be maintained for seven years, if I remember correctly. Effectively this would be a form of pre-emptive surveillance, where they do the surveillance first, and only decide later if they need to use it. There were a number of other provisions in the original bill. For example, it would be an imprisonable offence for a ISP employee to fail to comply with a request (properly made) to disclose this information. It would also be an imprisonable offence to inform the person under surveillance that this information had been disclosed, without limitation on time, and even if no charges or other action was ever taken against the client in question. Another concern, at the time, was that the bill was loosely worded in such a way that it was not clear what scope of services where included (for example, mobile phone text messages, telephone calls).

Technically most of these agencies would have had pre-existing powers to obtain this information if available. (e.g. Trade Descriptions Act). RIPA imposes a number of conditions on the use of such powers . (Hence Regulation of). This can cause problems dealing with rogue traders in that reverse directory information (freely available in many countries) is subject to the same restrictions as requests for the content of communications. This results in delays during which more consumers can be ripped off. Esthameian 06:50, 5 May 2007 (UTC)

Several points which may be helpful, all purely in relation to the Communications Data sections:

1. The IP data mentioned above is not currently held, but is now mandated by an extension to the EU Data Retention Directive, which already mandated retention of Voice data etc. and will now be expanded to cover IP data. This has not yet happened.

2. The Vast majority of requests made to Communications Service Providers (CSPs) are for "Subscriber Information" (i.e. reverse directory lookups)

3. Yes, some of the definition of data in the act is unclear, but the distinction between text messages and calls is not a significant one: this all falls under the middle category of Service Use Information, and only contains details of the call like start and end time, and number called.

4. I believe that before RIPA, Requests for Communications data from were made under exemptions from the Data Protection Act, written in free text (I have this on good authority, though admittedly a quick google has failed to throw up any easy evidence). At least under RIPA this exemption has to fall into a strictly limited and restricted set of categories e.g. Councils can only request data for the reason of preventing crime and disorder, whereas police forces can request data in the interests of national security, but not for the purposes of collecting tax.

5. Requests for Communications data do not involve use of "Warrants" (which are documents approved by a magistrate). They are made via a "Notice" or "Authorisation" served upon the CSP by a "Designated Person" within the requesting agency, who must be of a sufficient rank, and must be sufficiently versed in human rights legislation to judge that the infringement of the individual's human rights is proportionate to the crime/event/emergency in question. The request can even then not be directly served, but must go through the "Single Point of Contact" for that agency - a group trained to deal with the CSPs, and who have a responsibility to review all request and ensure that they are legal. Please see the Acquisition and disclosure of communications data code of practice - it's a human readable version of RIPA-Comms.

I know far too much about all this nonsense. (Leveret)82.22.6.4 (talk) 22:46, 23 March 2009 (UTC)

Name

Any reason for this not being at Regulation of Investigatory Powers? Were there two? Martin [22:24, 20 May 2003 (UTC)]

Not that I'm aware of; any objections to moving it? — Matt 07:11, 4 Sep 2004 (UTC)

Yes. All Acts are named thusly (that is, with their name as currently referenced in Law, in legal cases, and in Parliamentry work such as AoPs and SIs: "Foo Bar Act 1234"), with a very few exceptions. Keep here, but I'll add a redirect from several places.

James F. (talk) 12:34, 4 Sep 2004 (UTC)

Burden of proof

"The accused must prove that they do not have the key, claiming to have mislaid or forgotten it might not be accepted as a defence." What if the accused claims never to have possessed the key? The article is not clear on this point; the text of the Act seems to imply that a prosecutor needs to prove that the accused possessed the key at some time, but it isn't entirely clear and various popular accounts suggest the opposite.

AIUI, which is mainly a result of having talked about the Act with people who have read it and understand it far better than I ever will, the burden of proof would, rather inexplicably, rest on the defence, not the prosecution, in showing that the defendent had at no time had the said key. Lovely, isn't it? Maybe someone more knowledgable could comment, and correct/update?

James F. (talk) 01:11, 2 Sep 2004 (UTC)

This seems to be the case, but I don't know much about this. This site analyses a variety of scenarios, and number 14 touches on this, suggesting that Bob sending Alice a message using her public key is sufficient grounds to believe that Alice once owned a corresponding private key, "Alice had had the key"...— Matt 04:46, 3 Sep 2004 (UTC)

Number 14 relates to the reverse onus regarding continued possession, in a case where past possession is presumably an undisputed fact; "That Alice had had the key ... which indeed she had" is specifically listed as one of the things that the prosecution has to show. This example does not directly address the question of the onus of proof regarding whether the defendant ever possessed the key; I don't even see how one can read into it any inference from circumstantial evidence, as you are apparently doing.

I don't know if a New Statesman blog is considered reliable information but it contains a quotation from the CPS saying that if a defendant claims to have forgotten the key, the prosecution have to prove that this is not the case. http://www.newstatesman.com/blogs/the-staggers/2010/10/police-drage-password-sex

That being said, it's the Oliver Drage case where no such proof was given, so who's to say? Wikiditm (talk) 10:09, 30 May 2011 (UTC)

ahahh

Section III

Did section 3 not come into effect last October? Or am I confusing it with something else?Prlewis0 (talk) 20:10, 4 March 2008 (UTC)

lololol

Link to the act "currently in force" - no such thing exists at present

The link to the statute law database is absolutely NOT the current amended version- as far as I am aware, no fully amended version exists. I can speak mainly from the perspective of disclosure of communications data (Part 1, section 2), but I have looked into this at great length. The version linked to is (as far as I'm aware) exactly the same text as the link to the "original text".

The number of changes made to the actual text over the past 8 years are relatively infrequent, coming notably in 2003, 2005 and 2006, but the major changes have been in the list of Authorities, which was significantly expanded in 2003 and 2006, and altered by Myriad other acts which involved the creation/deletion/merging of authorities (e.g. HMRC, SOCA). The text linked to contains none of these changes, and thus is being mis-represented. (N.B. "Authority" ="type of agency" - RIPA mostly just specifies classes of agency, e.g. "A UK council" rather than naming specific agencies)

By way of evidence, please see the "Update Status Warning" on The Act itself, the page showing some of the Amendments to the act, and the interface through which you can find primary and secondary legislation which has modified the act:RIPA- Tables of legislative effects.
How should this matter proceed? I'm sure there are people there much better equipped to progress this than I. (Leveret)82.22.6.4 (talk) 22:16, 23 March 2009 (UTC)

Prosceutions under RIPA

I've tried to confirm the case of the chap jailed for refusing to hand over his encryption keys & can find no references outside one website and 'reprint' of that article. Whoever posted this in the first place, please reference the case properly or remove it...

Tattooed Librarian 11:12, 17 November 2010 (UTC)

Here is a reference. This case was extremely well reported and it's not hard to find references, googling for "Oliver Drage" will turn up hundreds.

Amoe (talk) 13:25, 14 December 2010 (UTC)

The link you provide refers to Oliver Drage. The first person jailed under RIPA was (according to the page reference) a UK :schizophrenic, referred to as 'JFL'.

Drage is a different case - he was a 19 y/o being investigated for alleged child sexual exploitation.

I still can't find a unique reference to the JFL case, other than 'The Register' and 'repeats' in blogs - maybe you can assist.

In the mean time, thanks for the 'Drage' reference - I've updated the main article to include this - it gives good balance.

Tattooed Librarian (talk) 15:17, 14 December 2010 (UTC)

Thanks for this! Amoe (talk) 18:58, 14 December 2010 (UTC)

ISTM that the phrase "child exploitation" is just being used here as a euphamism for child porn; why not call a spade a spade?

Assuming he was storing that kind of material, it would certainly drive home more effectivly the point about how apparently impotent the police/CPS are at investigating/prosecuting material which has been encrypted, and the punative nature of the RIPA for anyone refusing to co-operate in an investigation against them. Four months sounds "cheap" compared with what he could probably have expected had he obeyed the order to decrypt it.

OTOH, given that there's no evidence that he was in fact storing such material, perhaps the reference to "child exploitation" should be removed from the article on the basis it's not relevant and is purely speculative? From the references, it had no bearing on his prosecution and subsequent sentencing?

Nuwewsco (talk) 00:34, 15 December 2010 (UTC)

Unless I'm missing something, it's not up to editors to 'drive a point home' about anything. This is an article about RIPA, not about the police's ability to investigate certain types of case. The only relevance that 'ability' has is to say that for all other types of evidence seized (lawfully, with a search warrant or s.18 powers) the contents are obvious to all (such as paper records etc.). In the case of an encrypted computer, that is not so - the suspect can defeat a lawful search warrant. The offence is there to prevent people from doing this, by hiding potentially criminal materials behind a strong password, and both cases show this.

The reference to 'child exploitation' in the second case is not speculative - he was part of that investigation and that led to the request to provide the password - that is a factual reference to the circumstances that led to that request being made in that specific case.

Tattooed Librarian (talk) 14:06, 15 December 2010 (UTC)

Oliver Drage

Did Oliver Drage ever get out of prison? I know he was sentenced for 4 months, but there seemed to be the possibility that they would throw him back in jail again if he still refused to give out the password. —Preceding unsigned comment added by 71.194.190.179 (talk) 23:13, 4 March 2011 (UTC)

Neutrality

The summary of this article doesn't really meet NPOV guidelines — Preceding unsigned comment added by Jdraymon (talk • contribs) 23:11, 13 September 2012 (UTC)

Couldn't agree more - full of inaccuracies and very slanted. Anyone got the time for a full rewrite? Tattooed Librarian 13:47, 14 September 2012 (UTC) — Preceding unsigned comment added by TattooedLibrarian (talk • contribs)