Feeds

UK.gov closes wiretap loopholes after Phorm row

Race to avoid millions in fines

Providing a secure and efficient Helpdesk

The Home Office is scrambling to close loopholes in wiretapping law, revealed by the Phorm affair, ahead of a potentially costly court case against the European Commission.

It is proposing new powers that would punish even unintentional illegal interception by communications providers.

Officials in Brussels are suing the government following public complaints about BT's secret trials of Phorm's web interception and profiling technology, and about the failure of British authorities to take any action against either firm.

The government has now issued a consultation document proposing changes to the Regulation of Investigatory Powers Act (RIPA) that will mean customer consent for interception of their communications must be "freely given, specific and informed", in line with European law. RIPA currently allows interception where there is only "reasonable grounds for believing" consent is given.

The Commission's attention focused on this loophole after City of London Police declined to investigate the trials in 2008, saying "there would have been a level of implied consent from BT's customers in relation to the tests, as the aim was to enhance their products".

Despite police uninterest, the Crown Prosecution Service is considering criminal charges, following a private complaint. Legal experts, including from the Foundation for Information Policy Research, disputed the police claim there was "implied consent", particularly given internal BT documents obtained by The Register referred to the trials as "stealth" activity.

Further, informal advice written for BT by a Home Office official after the trials said user consent was required to make the system legal under RIPA. The CPS is due to report its decision on prosecution this month.

The European Commission's case against the government is however also based on the requirement under RIPA that for an offence to be committed, interception must be "intentional".

"EU law requires Members States to prohibit and to ensure sanctions against any unlawful interception regardless of whether committed intentionally or not," it said in September. There is no doubt the interception carried out by Phorm and BT was intentional, but the resulting controversy led Brussels to investigate related failings in UK privacy law.

The Home Office consultation proposes to create a new civil sanction against unintentional interception. The Interception of Communications Commissioner (IoCC), a former High Court judge who currently only regulates wiretapping by the intelligence agencies, would get new powers to act against ISPs and telephone operators.

Under the proposed regime, the IoCC would be able to fine firms guilty of unintentional wiretapping up to £10,000 and serve enforcement notices on them to stop.

Officials considered making all unauthorised interception a criminal offence, but rejected this option on grounds it would place a burden on the criminal justice system.

"This has significant advantages: it means that the process for dealing with the more minor cases of unintentional unlawful interception by providers can be allocated to a specialist body with statutory responsibility for oversight of this area," they wrote.

"This should make the enforcement process more streamlined and reduce the administrative burden on the police, the CPS and courts."

Intentional unlawful interception will remain a criminal offence under the proposed amendments to RIPA, punishable by a prison sentence of up to two years. This is the offence that prosecutors are considering charges under with respect to BT and Phorm's secret trials.

The Home Office document is available here. The unusually short consultation closes 7 December.

The haste is understandable. If the European Commission's case goes to the European Court of Justice in Luxembourg, and the government loses, the British taxpayer would face fines of millions of pounds per day until the legal loopholes are closed. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Brit telcos warn Scots that voting Yes could lead to HEFTY bills
BT and Co: Independence vote likely to mean 'increased costs'
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Blockbuster book lays out the first 20 years of the Smartphone Wars
Symbian's David Wood bares all. Not for the faint hearted
Bonking with Apple has POUNDED mobe operators' wallets
... into submission. Weve squeals, ditches payment plans
This flashlight app requires: Your contacts list, identity, access to your camera...
Who us, dodgy? Vast majority of mobile apps fail privacy test
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.