Feeds

UK.gov closes wiretap loopholes after Phorm row

Race to avoid millions in fines

Designing a Defense for Mobile Applications

The Home Office is scrambling to close loopholes in wiretapping law, revealed by the Phorm affair, ahead of a potentially costly court case against the European Commission.

It is proposing new powers that would punish even unintentional illegal interception by communications providers.

Officials in Brussels are suing the government following public complaints about BT's secret trials of Phorm's web interception and profiling technology, and about the failure of British authorities to take any action against either firm.

The government has now issued a consultation document proposing changes to the Regulation of Investigatory Powers Act (RIPA) that will mean customer consent for interception of their communications must be "freely given, specific and informed", in line with European law. RIPA currently allows interception where there is only "reasonable grounds for believing" consent is given.

The Commission's attention focused on this loophole after City of London Police declined to investigate the trials in 2008, saying "there would have been a level of implied consent from BT's customers in relation to the tests, as the aim was to enhance their products".

Despite police uninterest, the Crown Prosecution Service is considering criminal charges, following a private complaint. Legal experts, including from the Foundation for Information Policy Research, disputed the police claim there was "implied consent", particularly given internal BT documents obtained by The Register referred to the trials as "stealth" activity.

Further, informal advice written for BT by a Home Office official after the trials said user consent was required to make the system legal under RIPA. The CPS is due to report its decision on prosecution this month.

The European Commission's case against the government is however also based on the requirement under RIPA that for an offence to be committed, interception must be "intentional".

"EU law requires Members States to prohibit and to ensure sanctions against any unlawful interception regardless of whether committed intentionally or not," it said in September. There is no doubt the interception carried out by Phorm and BT was intentional, but the resulting controversy led Brussels to investigate related failings in UK privacy law.

The Home Office consultation proposes to create a new civil sanction against unintentional interception. The Interception of Communications Commissioner (IoCC), a former High Court judge who currently only regulates wiretapping by the intelligence agencies, would get new powers to act against ISPs and telephone operators.

Under the proposed regime, the IoCC would be able to fine firms guilty of unintentional wiretapping up to £10,000 and serve enforcement notices on them to stop.

Officials considered making all unauthorised interception a criminal offence, but rejected this option on grounds it would place a burden on the criminal justice system.

"This has significant advantages: it means that the process for dealing with the more minor cases of unintentional unlawful interception by providers can be allocated to a specialist body with statutory responsibility for oversight of this area," they wrote.

"This should make the enforcement process more streamlined and reduce the administrative burden on the police, the CPS and courts."

Intentional unlawful interception will remain a criminal offence under the proposed amendments to RIPA, punishable by a prison sentence of up to two years. This is the offence that prosecutors are considering charges under with respect to BT and Phorm's secret trials.

The Home Office document is available here. The unusually short consultation closes 7 December.

The haste is understandable. If the European Commission's case goes to the European Court of Justice in Luxembourg, and the government loses, the British taxpayer would face fines of millions of pounds per day until the legal loopholes are closed. ®

Securing Web Applications Made Simple and Scalable

More from The Register

next story
GoTenna: How does this 'magic' work?
An ideal product if you believe the Earth is flat
Google Nest, ARM, Samsung pull out Thread to strangle ZigBee
But there's a flaw in Google's IP-based IoT system
Orange spent weekend spamming customers with TXTs
Zero, not infinity, is the Magic Number customers want
US freemium mobile network eyes up Europe
FreedomPop touts 'free' calls, texts and data
Apple orders huge MOUNTAIN of 80 MILLION 'Air' iPhone 6s
Bigger, harder trouser bulges foretold for fanbois
'Two-speed internet' storm turns FCC.gov into zero-speed website
Deadline for comments on net neutrality shake-up extended to Friday
NBN Co execs: No FTTN product until 2015
Faster? Not yet. Cheaper? No data
Oh girl, you jus' didn't: Level 3 slaps Verizon in Netflix throttle blowup
Just hook us up to more 10Gbps ports, backbone biz yells in tit-for-tat spat
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.