Police go slow with encryption key terror powers
Is the threat enough?
Agentless Backup is Not a Myth
New powers to force terror suspects to hand over encryption keys have been used in only eight criminal investigations, prompting fears that police could be bypassing courts by spooking suspects with the mere threat of extra jail time.
Section 49 of the Regulation of Investigatory Powers Act 2001 (RIPA) has been used eight times since coming into force at the start of October, Home Secretary Jacqui Smith said.
Four of the cases were terrorism-related, and two people were charged for maintaining their refusal. Neither has been prosecuted yet, she said, responding to a parliamentary question from her Tory shadow, David Davis.
The Home Office told The Register that the four other investigations where the powers have been used were: conspiracy to murder; withholding information in relation to conspiracy to murder; conspiracy to defraud; and making indecent images of children.
In her parliamentary answer, Smith said that following the order, two of the encryption keys in the non-terrorism cases have been disclosed.
Simon Davies of Privacy International, which campaigned against section 49 of RIPA when legislation was being drafted, was surprised at the low figure. "That number is remarkable, given the abuse of RIPA by quangos and local councils," he said.
"It indicates to me the power was never really needed in the first place. However, it might be that the Home Office is having technical or legal problems using the power, especially around human rights legislation."
Failing to comply with a section 49 order is an offence and carries a prison sentence of up to five years. Investigators can only obtain a section 49 order from a judge in England and Wales, or from a County Sheriff in Scotland.
"I think it's likely that police are using the threat of the power to force people to disclose encryption keys - it carries a hefty prison sentence, and people could be being denied justice," Davies said.
The Home Office does not record if police threaten to use section 49 powers. A spokeswoman said it could not provide further details of the cases because it was a police operational matter. ®
COMMENTS
Oops...
I don't know whether the mods'll let me have this one, but having just read through my last hefty post:
"I see no reason to assume that most of them ... are just honest, taxpaying citizens trying to make the best of a bad lot"
Should of course have read:
"I see no reason NOT to assume that most of them ... are just honest, taxpaying citizens trying to make the best of a bad lot"
Okay, okay, I'm really going this time, sorry...
@ Mark
<< Because the main reason for it was to say that the police aren't using it, so it's not being abused and so don't worry about it. >>
Not quite what I meant. I meant that it seems inconsistent to me to imply first that the police are tyrannical oppressors because they're *expected* to abuse this law; then, when it becomes apparent that for the moment at least they're *not* abusing it, to accuse them of being oppressors on the basis of an *assumption* (apparently) that, well, they *must* be threatening people with it instead.
As I said, I can't see how those of an anti-police persuasion can have it both ways - it seems a bit doublethink to me.
<< Why is the law there if the police won't use it? >>
Well, nobody picked up on my earlier comment about the police passing the law... But that was intended to make the point that, despite the pre-emptive accusations being levelled at the police, it *isn't* actually them that pass laws: it's government. The police are simply duty-bound to *enforce* the laws. But, where the law is more a tool, like this one, it seems a positive thing to me that the police aren't (for the moment at least) taking the opportunity to exploit it.
<< Why is the police not abusing it mean that the law is OK? >>
It doesn't, at all. This particular law is very far from okay. But the bulk of the criticisms here - at least the ones I'm responding to - are being levelled at the 'pigs'. But if the law is created by our supposed 'representatives', and the police don't use it (at least as much as we feared they might, and at least at the moment), then the criticism should surely be directed at those who *made* the law.
<< And why is it OK to have a law that CAN be abused, even if the police aren't using it >>
Again, it's not okay. And again, the criticism that I'm responding to is that preemptive variety that's largely based on generalised prejudice against the police and a presumption that, as a law enforcement agency, they must be automatons bent on subjugating the population under the unyielding rule of a totalitarian dictatorship. I see no reason to assume that most of them (bearing in mind I accept that they have their share of idiots and crooks, just as every group does) are just honest, taxpaying citizens trying to make the best of a bad lot, but without the political rights that the rest of us have.
Maybe I am living in fluffy bunny land, at that: but if I'm going to err, I'd rather err towards extending someone the benefit of the doubt until I've reason to assume them guilty. That goes for all citizens, including those who work as police officers.
Again, my only real point is that if you want to criticise law, criticise those who MAKE it, not those who're duty- and mortgage-bound to comply with it.
That's pretty much all I can say on the subject, and since I must've used up a year's worth of comment space already, I'll bow out.
@Tasksis
Fair enough on your second post, but it does leave your first one flapping in the wind.
Because the main reason for it was to say that the police aren't using it, so it's not being abused and so don't worry about it.
That's what I took away from it anyway.
And your second post was correct. It just didn't say how the three things are connected. Why is the law there if the police won't use it? Why is the police not abusing it mean that the law is OK? And why is it OK to have a law that CAN be abused, even if the police aren't using it (because they'd have to use it before it can be abused).

IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Cloud based data management
Enabling efficient data center monitoring
Agentless Backup is Not a Myth