Part III of the draft Bill

(i)  We have seen nothing that would substantiate some hysterical comment to the effect that the Government's proposed new power to require decryption represents a major assault on our rights; subject to our recommendations below, we see no reason to depart from our earlier conclusion that the proposed new power would prove a useful addition to the armoury of the law enforcement agencies. If Home Office Ministers wish to proceed with part III of the draft Bill then they must explain in more detail than hitherto why the proposed new power should be introduced with such urgency.

The Government welcomes the Committee's conclusion that, subject to the recommendations contained in its report, the proposed new decryption powers would prove useful to law enforcement. The Government listened and reflected on how best to take forward the proposals set out in the draft Electronic Communications Bill and, as the Committee will know, decided to legislate separately during the current session of Parliament to modernise law enforcement powers in this area. The Home Office will bring forward legislative proposals, together with those for updating the law on the interception of communications and other intrusive investigative techniques, in the forthcoming Regulation of Investigatory Powers (RIP) Bill.

(j)  We have heard significant expressions of dissatisfaction with the present regime for interception of communications, particularly concerning the lack of judicial oversight including from the Data Protection Registrar in evidence to us in March 1999. We would expect these concerns to be addressed fully by the Government when it responds to the consultation exercise on the future of the interceptions regime. We also recommend that the Government seek ways of alleviating the cost burden on smaller internet service providers of extending the scope of the interception of communications regime, and requiring decryption of intercepted encrypted messages, if necessary, by ensuring that the burden is shared on a proportionate basis.

In the consultation paper outlining plans for updating the law on the interception of communications[2], the Government proposed to continue with the long established principle of Secretary of State authorisation of interception. Alternative options had been examined but on balance, the Government was not persuaded that the current practice should be altered. The Government has considered carefully all the responses received to the interception consultation exercise (details of which have now been published on the Home Office website[3]) but remains of the view that the power to authorise interception warrants should continue to be vested in the Secretary of State. There will continue to be an independent Commissioner with responsibility for overseeing the Secretary of State's use of the power of interception. The Government believes that the Commissioner fulfils an important and effective oversight role.

As regards costs, large parts of the telecommunications industry are covered by the current interception legislation and will incur little or no extra cost under the proposals to update the law. The Government is consulting in order to get a balanced view from across the industry, including the Internet Service Provider community, of what constitutes a reasonable intercept requirement. There is no intention of imposing burdens on industry which are anything other than reasonable.

(k)  We recommend that the legislation address the issue of the extent to which all or some non-Home Office police forces should be given the powers and duties proposed in part III of the draft Bill.

The Government is looking carefully at whether, and how best, to cover non-Home Office police forces as regards the proposed decryption powers in the forthcoming RIP Bill.

(l)  We recommend that the Government make available to Parliament before second reading of the Bill the criteria concerning the circumstances in which a written notice for decryption will be able to require the production of a private key.

The Government will seek to make available to Parliament, during the passage of the forthcoming RIP Bill, the criteria concerning the circumstances in which decryption keys rather than an intelligible version of protected data may be required. It is envisaged that this will be covered in the proposed Code of Practice. The Government would also reiterate the response made to the Committee's previous query on this point - it is envisaged that the disclosure of an intelligible version of protected data in response to a decryption notice will be sufficient in most cases.

(m)  We recommend that the legislation explicitly addresses the question of the exemption of privileged material from the scope of written decryption notices.

The proposed new decryption powers will not undermine safeguards in existing legislation governing access to privileged material. For example, under the Police and Criminal Evidence Act 1984 (PACE), the authority of a Circuit Judge is required for access to e.g. legally privileged or journalistic material. It is proposed that use of the decryption power in such circumstances will require the same level of authorisation.

(n)  We recommend that the Government give some indication as to how it is envisaged that those served with written notices requiring plain text or encryption keys can successfully demonstrate that they cannot comply with the notice. We agree with the underlying aim of the tipping-off offence, but seek assurances that it will be used against only those people who deliberately and intentionally seek to subvert the work of the law enforcement agencies. We recommend that, once the legislation is in force, the Government keeps under review the penalties for the offences of tipping-off and failure to comply with a written notice.

The Government recognises that the proposed offences contained in the draft Bill have aroused much comment from interested parties. The construction of the relevant draft Clauses is being examined carefully in the light of the responses to the consultation exercise on the draft Bill. The Committee may be assured that it is the Government's intention that the new offences seek to target the criminal or their associates, not the legitimate or innocent user of encryption technologies. The penalties for the proposed offences will be kept under review once the legislation is in force.

(o)  The proposed code of practice may prove toothless. We recommend that:

­  any person exercising or performing any power or duty under part III of the legislation should have an enforceable duty to follow the requirements of the proposed code of practice at all times

­  procedures are established to report, independently monitor and publish details of breaches of the proposed code of practice, possibly through the good offices of the proposed Commissioner.   

The Government is considering carefully how the proposed statutory Code of Practice is to be best operated. The view of the Committee, as well as other commentators on the draft Bill, will be taken into account in bringing forward the RIP Bill.

Legislation

(cc)  Having certified that legislation does not contravene the European Convention on Human Rights, Ministers must be able to demonstrate, when challenged, that this is indeed the case. We recommend that the Government publish a detailed analysis to substantiate its confidence that part III of the draft Bill does not contravene the European Convention on Human Rights, dealing with the points made to the contrary.

The Government has every intention of ensuring that all the provisions of the forthcoming RIP Bill are ECHR compatible. And the Government will be very happy to explain why it believes the provisions to be ECHR compatible when faced with specific argument to the contrary. All such discussion should take place against the backdrop that any challenges to legislation on these grounds will rely on the specific nature of the case in question. Therefore, these issues are hard to deal with comprehensively in advance of any particular challenge.