Feeds

UK.gov closes wiretap loopholes after Phorm row

Race to avoid millions in fines

Build a business case: developing custom apps

The Home Office is scrambling to close loopholes in wiretapping law, revealed by the Phorm affair, ahead of a potentially costly court case against the European Commission.

It is proposing new powers that would punish even unintentional illegal interception by communications providers.

Officials in Brussels are suing the government following public complaints about BT's secret trials of Phorm's web interception and profiling technology, and about the failure of British authorities to take any action against either firm.

The government has now issued a consultation document proposing changes to the Regulation of Investigatory Powers Act (RIPA) that will mean customer consent for interception of their communications must be "freely given, specific and informed", in line with European law. RIPA currently allows interception where there is only "reasonable grounds for believing" consent is given.

The Commission's attention focused on this loophole after City of London Police declined to investigate the trials in 2008, saying "there would have been a level of implied consent from BT's customers in relation to the tests, as the aim was to enhance their products".

Despite police uninterest, the Crown Prosecution Service is considering criminal charges, following a private complaint. Legal experts, including from the Foundation for Information Policy Research, disputed the police claim there was "implied consent", particularly given internal BT documents obtained by The Register referred to the trials as "stealth" activity.

Further, informal advice written for BT by a Home Office official after the trials said user consent was required to make the system legal under RIPA. The CPS is due to report its decision on prosecution this month.

The European Commission's case against the government is however also based on the requirement under RIPA that for an offence to be committed, interception must be "intentional".

"EU law requires Members States to prohibit and to ensure sanctions against any unlawful interception regardless of whether committed intentionally or not," it said in September. There is no doubt the interception carried out by Phorm and BT was intentional, but the resulting controversy led Brussels to investigate related failings in UK privacy law.

The Home Office consultation proposes to create a new civil sanction against unintentional interception. The Interception of Communications Commissioner (IoCC), a former High Court judge who currently only regulates wiretapping by the intelligence agencies, would get new powers to act against ISPs and telephone operators.

Under the proposed regime, the IoCC would be able to fine firms guilty of unintentional wiretapping up to £10,000 and serve enforcement notices on them to stop.

Officials considered making all unauthorised interception a criminal offence, but rejected this option on grounds it would place a burden on the criminal justice system.

"This has significant advantages: it means that the process for dealing with the more minor cases of unintentional unlawful interception by providers can be allocated to a specialist body with statutory responsibility for oversight of this area," they wrote.

"This should make the enforcement process more streamlined and reduce the administrative burden on the police, the CPS and courts."

Intentional unlawful interception will remain a criminal offence under the proposed amendments to RIPA, punishable by a prison sentence of up to two years. This is the offence that prosecutors are considering charges under with respect to BT and Phorm's secret trials.

The Home Office document is available here. The unusually short consultation closes 7 December.

The haste is understandable. If the European Commission's case goes to the European Court of Justice in Luxembourg, and the government loses, the British taxpayer would face fines of millions of pounds per day until the legal loopholes are closed. ®

The essential guide to IT transformation

More from The Register

next story
6 Obvious Reasons Why Facebook Will Ban This Article (Thank God)
Clampdown on clickbait ... and El Reg is OK with this
So, Apple won't sell cheap kit? Prepare the iOS garden wall WRECKING BALL
It can throw the low cost race if it looks to the cloud
EE accused of silencing customer gripes on social media pages
Hello. HELLO. Can EVERYTHING EVERYWHERE HEAR ME?!
Time Warner Cable customers SQUEAL as US network goes offline
A rude awakening: North Americans greeted with outage drama
Shoot-em-up: Sony Online Entertainment hit by 'large scale DDoS attack'
Games disrupted as firm struggles to control network
BT customers face broadband and landline price hikes
Poor punters won't be affected, telecoms giant claims
Netflix swallows yet another bitter pill, inks peering deal with TWC
Net neutrality crusader once again pays up for priority access
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.