Feeds

UK.gov closes wiretap loopholes after Phorm row

Race to avoid millions in fines

Top 5 reasons to deploy VMware with Tegile

The Home Office is scrambling to close loopholes in wiretapping law, revealed by the Phorm affair, ahead of a potentially costly court case against the European Commission.

It is proposing new powers that would punish even unintentional illegal interception by communications providers.

Officials in Brussels are suing the government following public complaints about BT's secret trials of Phorm's web interception and profiling technology, and about the failure of British authorities to take any action against either firm.

The government has now issued a consultation document proposing changes to the Regulation of Investigatory Powers Act (RIPA) that will mean customer consent for interception of their communications must be "freely given, specific and informed", in line with European law. RIPA currently allows interception where there is only "reasonable grounds for believing" consent is given.

The Commission's attention focused on this loophole after City of London Police declined to investigate the trials in 2008, saying "there would have been a level of implied consent from BT's customers in relation to the tests, as the aim was to enhance their products".

Despite police uninterest, the Crown Prosecution Service is considering criminal charges, following a private complaint. Legal experts, including from the Foundation for Information Policy Research, disputed the police claim there was "implied consent", particularly given internal BT documents obtained by The Register referred to the trials as "stealth" activity.

Further, informal advice written for BT by a Home Office official after the trials said user consent was required to make the system legal under RIPA. The CPS is due to report its decision on prosecution this month.

The European Commission's case against the government is however also based on the requirement under RIPA that for an offence to be committed, interception must be "intentional".

"EU law requires Members States to prohibit and to ensure sanctions against any unlawful interception regardless of whether committed intentionally or not," it said in September. There is no doubt the interception carried out by Phorm and BT was intentional, but the resulting controversy led Brussels to investigate related failings in UK privacy law.

The Home Office consultation proposes to create a new civil sanction against unintentional interception. The Interception of Communications Commissioner (IoCC), a former High Court judge who currently only regulates wiretapping by the intelligence agencies, would get new powers to act against ISPs and telephone operators.

Under the proposed regime, the IoCC would be able to fine firms guilty of unintentional wiretapping up to £10,000 and serve enforcement notices on them to stop.

Officials considered making all unauthorised interception a criminal offence, but rejected this option on grounds it would place a burden on the criminal justice system.

"This has significant advantages: it means that the process for dealing with the more minor cases of unintentional unlawful interception by providers can be allocated to a specialist body with statutory responsibility for oversight of this area," they wrote.

"This should make the enforcement process more streamlined and reduce the administrative burden on the police, the CPS and courts."

Intentional unlawful interception will remain a criminal offence under the proposed amendments to RIPA, punishable by a prison sentence of up to two years. This is the offence that prosecutors are considering charges under with respect to BT and Phorm's secret trials.

The Home Office document is available here. The unusually short consultation closes 7 December.

The haste is understandable. If the European Commission's case goes to the European Court of Justice in Luxembourg, and the government loses, the British taxpayer would face fines of millions of pounds per day until the legal loopholes are closed. ®

Security for virtualized datacentres

More from The Register

next story
TEEN RAMPAGE: Kids in iPhone 6 'Will it bend' YouTube 'prank'
iPhones bent in Norwich? As if the place wasn't weird enough
Consumers agree to give up first-born child for free Wi-Fi – survey
This Herod network's ace – but crap reception in bullrushes
Crouching tiger, FAST ASLEEP dragon: Smugglers can't shift iPhone 6s
China's grey market reports 'sluggish' sales of Apple mobe
Sea-Me-We 5 construction starts
New sub cable to go live 2016
New EU digi-commish struggles with concepts of net neutrality
Oettinger all about the infrastructure – but not big on substance
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
EE coughs to BROKEN data usage metrics BLUNDER that short-changes customers
Carrier apologises for 'inflated' measurements cockup
Comcast: Help, help, FCC. Netflix and pals are EXTORTIONISTS
The others guys are being mean so therefore ... monopoly all good, yeah?
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.