Computing related legislation: Regulation of Investigatory Powers Act 2000

Overview

Recall questions on the Regulation of Investigatory Powers Act 2000, content and communications data, notices to disclose encryption keys, safeguards and scope creep, workplace interception, and applying the four main computing Acts to scenarios.

What you need to know

Answer each one before you reveal it.

Questions from this subtopic

Each one with the model answer underneath.

1. 1

   What does the Regulation of Investigatory Powers Act 2000 regulate, and why was an Act needed to permit surveillance rather than to ban it?

   Model answer

   It provides a statutory framework governing when public bodies may use covert investigatory techniques and how those uses are authorised and overseen. Its main areas are: the interception of communications, meaning reading the content of a communication in the course of its transmission; the acquisition and disclosure of communications data, meaning the who, when, where and how rather than the content; intrusive surveillance, meaning covert surveillance of residential premises or a private vehicle; directed surveillance, meaning covert surveillance of a person in a way likely to obtain private information; the conduct and use of covert human intelligence sources, meaning undercover officers and informants; and the power to require disclosure of protected, that is encrypted, electronic data. The reason it reads as a permitting Act is the Human Rights Act 1998, which requires any interference with the right to respect for private and family life to be in accordance with the law and necessary and proportionate for a legitimate aim such as national security or preventing crime. Without a clear legal basis and safeguards, surveillance that was previously done under vague common law powers would have been unlawful, so the Act supplies the legal basis and the limits together.

2. 2

   Explain the difference between the content of a communication and communications data, and why the law treats them differently.

   Model answer

   Content is what was actually said or written: the body of an email, the words of a phone call, the text of a message. Communications data is everything about the communication other than its content: who contacted whom, the numbers or addresses involved, the date, time and duration, the type of service, and, for mobile communications, the location of the handset. The law treats them differently because obtaining content is regarded as a more serious intrusion, so interception has historically required a warrant signed at the highest level, whereas communications data could be acquired on an internal authorisation by a designated senior officer within a much wider range of public bodies. The distinction is criticised on the ground that communications data can be at least as revealing as content: knowing that a person telephoned an oncology clinic, then a solicitor, then a life insurer discloses a great deal without a word of any conversation being read. Modern practice recognises this by tightening the authorisation requirements for communications data, notably by requiring independent approval.

3. 3

   The Regulation of Investigatory Powers Act contains a power over encrypted material that has no equivalent in the other computing legislation. Describe it.

   Model answer

   A person with appropriate permission may serve a notice on someone believed to hold a key to protected electronic data, requiring them either to put the material into an intelligible form or, in defined circumstances, to hand over the key itself. The notice can be served only where it is necessary in the interests of national security, for preventing or detecting crime, or in the interests of the economic well-being of the United Kingdom, and where the requirement is proportionate and the material could not reasonably be obtained another way. Failing to comply is a criminal offence carrying up to two years' imprisonment, rising to five years in national security cases and cases concerning indecent images of children. A defence exists for a person who no longer holds the key, but the burden of raising it sits awkwardly with the general presumption of innocence, and critics argue the power effectively compels self-incrimination and cannot distinguish a suspect who refuses from one who has genuinely forgotten a passphrase. Supporters answer that without it strong encryption would place otherwise lawfully obtained evidence permanently beyond reach.

4. 4

   How were the powers in the Regulation of Investigatory Powers Act supposed to be kept in check?

   Model answer

   By four mechanisms. First, a graded authorisation scheme, so the more intrusive the technique the higher the authority required: interception of content needed a warrant personally signed by a Secretary of State, intrusive surveillance needed senior authorisation with prior approval by a Commissioner in most cases, while directed surveillance and communications data could be authorised internally by a designated officer. Second, statutory tests written into every authorisation: the activity had to be necessary for one of the listed purposes and proportionate to what it sought to achieve. Third, independent oversight by Commissioners, notably the Interception of Communications Commissioner and the Chief Surveillance Commissioner, who inspected public bodies and reported publicly. Fourth, a route of complaint for individuals to the Investigatory Powers Tribunal, a specialist judicial body with power to quash authorisations, order the destruction of records and award compensation, and which can hear cases even where the state will neither confirm nor deny that surveillance took place.

5. 5

   Local councils were criticised for using the Regulation of Investigatory Powers Act to check whether parents lived in a school catchment area. What was the objection, and what changed?

   Model answer

   The objection was proportionality and scope creep. The Act made directed surveillance available to a long list of public authorities on internal authorisation, so a council could authorise covert observation of a family for a matter that many people regarded as trivial relative to the intrusion, and a framework that had been justified to Parliament by reference to terrorism and serious crime was being used for suspected school-place fraud, dog fouling and littering. Defenders pointed out that the councils were following the statutory tests as written and that fraud is still fraud. Parliament responded in the Protection of Freedoms Act 2012, which made local authority use of directed surveillance, covert human intelligence sources and communications data subject to approval by a magistrate before it takes effect, and an order made alongside it restricted local authority directed surveillance to investigating offences carrying a maximum sentence of at least six months, with exceptions for underage sales of alcohol and tobacco. It is a useful case study in the gap between what a power was sold as and what its words permit.

6. 6

   An employer wants to read staff email to check for leaks of commercial information. Does the Regulation of Investigatory Powers Act let them?

   Model answer

   The Act's interception provisions apply to private telecommunication systems as well as public ones, so an employer's mail server is within scope and interception without lawful authority can give rise to civil liability and, for public systems, criminal liability. There are, however, routes to lawfulness. Interception is lawful where the employer has reasonable grounds to believe both sender and recipient have consented. It is also lawful under regulations made under the Act, the lawful business practice regulations, which permit a business to monitor or record communications on its own system without consent for defined purposes including establishing facts, ascertaining compliance with regulatory practices, preventing or detecting crime, and investigating unauthorised use of the system, provided the business has made all reasonable efforts to inform users that interception may take place. So the practical answer is that monitoring is possible but conditional: there must be a legitimate business purpose, users must have been told, typically through an acceptable use policy, and the monitoring must still satisfy data protection duties of fairness and proportionality, which means blanket reading of all personal correspondence would remain vulnerable to challenge.

Other ways to work this

The same content, four other ways.

What is inside Levo

Six ways to work the same material.