Investigation of Electronic Data Protected by Encryption
Encryption protects electronic messages from unauthorised access and use which is particularly important for secure Internet and email use. Increased use of encryption technologies has prompted the Government to enact controversial legislation allowing access to electronic data protected by encryption
In order to open an encrypted message, an electronic ‘key’ is needed. Under Part III of RIPA, there is power for authorised persons to serve a ‘Section 49 Notice’ on a person. The notice can be used to require a person to provide information, which may be protected by a key where such disclosure is necessary in the interests of national security, for the prevention or detection of crime or in the interests of the economic well-being of the UK, or for securing the effective exercise by any public authority of any statutory power or duty. No notice should be issued unless it is proportionate and it is not reasonably practicable to obtain the information without giving notice.
The notice must be in writing and must specify the nature of the protected information sought. The person who receives the notice will then be entitled to use the key in his or her possession to obtain access to the encrypted information, and then to disclose that information in intelligible form. This process will not require disclosure of the key itself. Disclosure of the key itself may be required, but only where there are special circumstances where to direct otherwise would defeat the object of the disclosure, and the requirement for disclosing the key is proportionate.
Authorisation for the issue of such notices must be obtained in accordance with the requirements of Schedule 2 of RIPA.
The ability to obtain access to encrypted messages represents a significant interference with the right to private life, as well as potentially undermining the effective development of e-commerce. It remains to be seen how the courts will look at the use of such powers to obtain disclosure of sensitive material in light of Article 8 of the Convention.
In order to open an encrypted message, an electronic ‘key’ is needed. Under Part III of RIPA, there is power for authorised persons to serve a ‘Section 49 Notice’ on a person. The notice can be used to require a person to provide information, which may be protected by a key where such disclosure is necessary in the interests of national security, for the prevention or detection of crime or in the interests of the economic well-being of the UK, or for securing the effective exercise by any public authority of any statutory power or duty. No notice should be issued unless it is proportionate and it is not reasonably practicable to obtain the information without giving notice.
The notice must be in writing and must specify the nature of the protected information sought. The person who receives the notice will then be entitled to use the key in his or her possession to obtain access to the encrypted information, and then to disclose that information in intelligible form. This process will not require disclosure of the key itself. Disclosure of the key itself may be required, but only where there are special circumstances where to direct otherwise would defeat the object of the disclosure, and the requirement for disclosing the key is proportionate.
Authorisation for the issue of such notices must be obtained in accordance with the requirements of Schedule 2 of RIPA.
The ability to obtain access to encrypted messages represents a significant interference with the right to private life, as well as potentially undermining the effective development of e-commerce. It remains to be seen how the courts will look at the use of such powers to obtain disclosure of sensitive material in light of Article 8 of the Convention.
