Talk:Regulation of Investigatory Powers Act 2000

The Nature of the RIP Act

Just referenced this to check for a commencement date and was appalled at the article - it's not factually accurate. Start with "At the passing of the act only nine organisations (including the police and security services) were allowed to invoke it, but as of 2008, it was 792 organizations (including 474 councils).[1]"

The original Act names all these :

1 Any police force.

2 The National Criminal Intelligence Service.

3 The National Crime Squad.

4 The Serious Fraud Office.

The intelligence services

5 Any of the intelligence services.

The armed forces

6 Any of Her Majesty’s forces.

The revenue departments

7 The Commissioners of Customs and Excise.

8 The Commissioners of Inland Revenue.

Government departments

9 The Ministry of Agriculture, Fisheries and Food.

10 The Ministry of Defence.

11 The Department of the Environment, Transport and the Regions.

12 The Department of Health.

13 The Home Office.

14 The Department of Social Security.

15 The Department of Trade and Industry.

The National Assembly for Wales

16 The National Assembly for Wales.

Local authorities

17 Any local authority (within the meaning of section 1 of the [1999 c. 27.] Local Government Act 1999).

Other bodies

18 The Environment Agency.

19 The Financial Services Authority.

20 The Food Standards Agency.

21 The Intervention Board for Agricultural Produce.

22 The Personal Investment Authority.

23 The Post Office.

Part II Relevant authorities for the purposes only of s. 28

The Health and Safety Executive

24 The Health and Safety Executive.

NHS bodies in England and Wales

25 A Health Authority established under section 8 of the [1977 c. 49.] National Health Service Act 1977.

26 A Special Health Authority established under section 11 of the [1977 c. 49.] National Health Service Act 1977.

27 A National Heath Service trust established under section 5 of the [1990 c. 19.] National Health Service and Community Care Act 1990.

The Royal Pharmaceutical Society of Great Britain

28 The Royal Pharmaceutical Society of Great Britain.

I propose to make a full scale rewrite to this, unless someone 'in authority' suggests otherwise. (FYI - I work in the UK teaching investigation law, so I know that of which I speak!!)Tattooed Librarian (talk) 14:33, 6 May 2009 (UTC)

This article is rather cryptic on the nature of the burden placed on ISPs, and it's civil liberties implications. As I understand it the ISPs are required to maintain a database of all internet access by all their clients: so every web page requested, email sent, etc, has it's header information (but not the full content) recorded by the ISP, to be made available to various agencies on request (originally only with a warrant I believe, but that may have been weakened; they certainly wanted to open it up to a much wider group of agencies). The data thus collected was to be maintained for seven years, if I remember correctly. Effectively this would be a form of pre-emptive surveillance, where they do the surveillance first, and only decide later if they need to use it. There were a number of other provisions in the original bill. For example, it would be an imprisonable offence for a ISP employee to fail to comply with a request (properly made) to disclose this information. It would also be an imprisonable offence to inform the person under surveillance that this information had been disclosed, without limitation on time, and even if no charges or other action was ever taken against the client in question. Another concern, at the time, was that the bill was loosely worded in such a way that it was not clear what scope of services where included (for example, mobile phone text messages, telephone calls).

Technically most of these agencies would have had pre-existing powers to obtain this information if available. (e.g. Trade Descriptions Act). RIPA imposes a number of conditions on the use of such powers . (Hence Regulation of). This can cause problems dealing with rogue traders in that reverse directory information (freely available in many countries) is subject to the same restrictions as requests for the content of communications. This results in delays during which more consumers can be ripped off. Esthameian 06:50, 5 May 2007 (UTC)

Several points which may be helpful, all purely in relation to the Communications Data sections:

1. The IP data mentioned above is not currently held, but is now mandated by an extension to the EU Data Retention Directive, which already mandated retention of Voice data etc. and will now be expanded to cover IP data. This has not yet happened.

2. The Vast majority of requests made to Communications Service Providers (CSPs) are for "Subscriber Information" (i.e. reverse directory lookups)

3. Yes, some of the definition of data in the act is unclear, but the distinction between text messages and calls is not a significant one: this all falls under the middle category of Service Use Information, and only contains details of the call like start and end time, and number called.

4. I believe that before RIPA, Requests for Communications data from were made under exemptions from the Data Protection Act, written in free text (I have this on good authority, though admittedly a quick google has failed to throw up any easy evidence). At least under RIPA this exemption has to fall into a strictly limited and restricted set of categories e.g. Councils can only request data for the reason of preventing crime and disorder, whereas police forces can request data in the interests of national security, but not for the purposes of collecting tax.

5. Requests for Communications data do not involve use of "Warrants" (which are documents approved by a magistrate). They are made via a "Notice" or "Authorisation" served upon the CSP by a "Designated Person" within the requesting agency, who must be of a sufficient rank, and must be sufficiently versed in human rights legislation to judge that the infringement of the individual's human rights is proportionate to the crime/event/emergency in question. The request can even then not be directly served, but must go through the "Single Point of Contact" for that agency - a group trained to deal with the CSPs, and who have a responsibility to review all request and ensure that they are legal. Please see the Acquisition and disclosure of communications data code of practice - it's a human readable version of RIPA-Comms.

I know far too much about all this nonsense. (Leveret)82.22.6.4 (talk) 22:46, 23 March 2009 (UTC)

Name

Any reason for this not being at Regulation of Investigatory Powers? Were there two? Martin [22:24, 20 May 2003 (UTC)]

Not that I'm aware of; any objections to moving it? — Matt 07:11, 4 Sep 2004 (UTC)

Yes. All Acts are named thusly (that is, with their name as currently referenced in Law, in legal cases, and in Parliamentry work such as AoPs and SIs: "Foo Bar Act 1234"), with a very few exceptions. Keep here, but I'll add a redirect from several places.

James F. (talk) 12:34, 4 Sep 2004 (UTC)

Burden of proof

"The accused must prove that they do not have the key, claiming to have mislaid or forgotten it might not be accepted as a defence." What if the accused claims never to have possessed the key? The article is not clear on this point; the text of the Act seems to imply that a prosecutor needs to prove that the accused possessed the key at some time, but it isn't entirely clear and various popular accounts suggest the opposite.

AIUI, which is mainly a result of having talked about the Act with people who have read it and understand it far better than I ever will, the burden of proof would, rather inexplicably, rest on the defence, not the prosecution, in showing that the defendent had at no time had the said key. Lovely, isn't it? Maybe someone more knowledgable could comment, and correct/update?

James F. (talk) 01:11, 2 Sep 2004 (UTC)

This seems to be the case, but I don't know much about this. This site analyses a variety of scenarios, and number 14 touches on this, suggesting that Bob sending Alice a message using her public key is sufficient grounds to believe that Alice once owned a corresponding private key, "Alice had had the key"...— Matt 04:46, 3 Sep 2004 (UTC)

Number 14 relates to the reverse onus regarding continued possession, in a case where past possession is presumably an undisputed fact; "That Alice had had the key ... which indeed she had" is specifically listed as one of the things that the prosecution has to show. This example does not directly address the question of the onus of proof regarding whether the defendant ever possessed the key; I don't even see how one can read into it any inference from circumstantial evidence, as you are apparently doing.

I don't know if a New Statesman blog is considered reliable information but it contains a quotation from the CPS saying that if a defendant claims to have forgotten the key, the prosecution have to prove that this is not the case. http://www.newstatesman.com/blogs/the-staggers/2010/10/police-drage-password-sex

That being said, it's the Oliver Drage case where no such proof was given, so who's to say? Wikiditm (talk) 10:09, 30 May 2011 (UTC)

Misunderstanding of effects

The title is the Regulation, not the Provision. of investigatory powers. Headlines about the application of the Act to local Councils included claims of 'Dustbin men reading your e-amils' whereas the application was to limit powers already contained in e.g. Trade Marks Act

since someoner did not like the following comments on the main page, I repeat them hee

"It should be noted that a number of these criticisms were based on the incorrect perception that RIPA gave Local Authorities additional powers. The decision to introduce RIPA was at least in part based on the realisation that there was no specific prohibition on the use of directed surveillance, which was in common use by Local Authority officers with enforcement responsibiities. " — Preceding unsigned comment added by 91.213.110.4 (talk) 11:19, 25 July 2013 (UTC)

This is entirely correct - and is as annoying as the common press use of the term 'anti-terrorism legislation' when discussing RIPA. Note that Local Authorities are not required to use RIPA to authorise surveillance (see the OSC website Q&A) and that non-RIPA surveillance is perfectly admissible.Tattooed Librarian 18:24, 28 July 2013 (UTC) — Preceding unsigned comment added by TattooedLibrarian (talk • contribs)

Section III

Did section 3 not come into effect last October? Or am I confusing it with something else?Prlewis0 (talk) 20:10, 4 March 2008 (UTC)

Poole Borough Council

The family involved within the Poole Borough Council incident, claimed that the purpose of the Regulation of Investigatory Powers Act 2000 was to track both criminals and terrorists.

The use of the word 'terrorist' in this context is inflammatory. Indeed the long title of the Act contains no reference to terrorists or terrorism. The Act was however designed to regulate the carrying out of surveillance, an aim to which it appeared to achieve in this case. As after extensive surveillance, the family were exonerated from any 'criminal' wrongdoing and their daughter was awarded a place at the school of her choice.

Whist it can be argued that the resort to RIPA was disproportionate, inflammatory language such as "there have already been accusations of overkill following a case where the act was used by council bureaucrats to put three young children and their parents under surveillance to check whether they lived in a particular school catchment area" should be avoided.

Leebobs (talk) 22:28, 11 April 2008 (UTC)

The Council did not 'resort' to RIPA - RIPA does not provide powers of surveillance. In fact, they may not have needed to obtain RIPA authorisation at all if all they observed was public activity. The National Police Improvement Agency publication 'The Covert Journal' (despite its title available for download from the agency) has stated that "The use of surveillance and other covert techniques does not require authorisation under the Regulation of Investigatory Powers Act 2000 ...". The courts in the Naomi Cambell versus paparazzi case have said that there can be no reasonable expectation of privacy for public activities.

Also note that if any of the three families in the Poole case (NB those caught out have not complained!)had been taken to court they could have been charged with uttering a false document (2 years inside) or fraud (up to 7 years imprisonment).—Preceding unsigned comment added by 86.27.171.11 (talk • contribs) 21:37, 22 June 2008 (UTC)

According to the BBC,[1] the council did resort to using powers from the RIPA in this case. Do you have a source to support your position that they did not use such powers or that such powers do not even exist? Road Wizard (talk) 21:54, 22 June 2008 (UTC)

try the Covert Journal as above. The BBC is merely repeating news agencies reports which are incorrect. Also try reading the Act. most of the news reports are generated by a particular Euro MP.

Also see the LACORS parliamentary briefing at [2] which specifically states that the Act does not provide powers.

The real problem is media generated bigotry against Local Government - the officers using this legislation are those with investigatory powers and these are generally highly educated and professional. One of the main users is Trading Standards and the basic qualification includes a degree - our local TS department has 12 officers, 5 fully qualified, two trainees and staff have 9 other degrees between them including 2 with law degrees. A long step from the media's apocryphal unqualifed school leavers!—Preceding unsigned comment added by 87.127.33.50 (talk • contribs) 22:32, 25 June 2008 (UTC)

I have read the LACORS briefing and it appears you are misquoting it. While it does say "It should be emphasized that RIPA does not provide any powers to carry out covert activities." it also says "Councils in England, Wales and Northern Ireland can use RIPA to undertake directed surveillance, authorise covert human intelligence sources (CHIS) and access communications data..." This appears to be a very interesting distinction. Council officers have no powers to carry out covert activities themselves, but they have the power to authorise a CHIS to gather covert information on their behalf. Also the Act makes a clear definition of what is considered "covert" (section 26 (9)). By the Act's definition surveillance is not necessarily covert so would not be covered by LACORS's point about covert activities.

Referring back to the Act, as you so kindly suggested, Section 28 gives the "power to grant authorisations for the carrying out of directed surveillance" and Section 29 gives the "power to grant authorisations for the conduct or the use of a covert human intelligence source." This appears to be at odds with your statement of the Act not granting any powers in this regard. Local authorities are granted access to the powers of Sections 28 & 29 through their presence in Schedule 1, Part 1, of the Act "Any local authority (within the meaning of section 1 of the Local Government Act 1999".

Now are there any other outstanding issues on this matter? Road Wizard (talk) 23:29, 25 June 2008 (UTC)

You are failing to distinguish between the power to grant authority to carry out the activity and the power to carry out the activity itself. One point I am trying to make clear is that Councils are not carrying out any new activities - it is simply that these activities now require authorisation under RIPA. Example: Fraudulent one-day sales were illegal under the Mock Auctions Act (now the CUPTR). This was LA sponsored legislation because this affected their residents directly. The only reliable way to prove the offence was to record the whole of the sale. This was routinely done until the advent of the HRA and consequently RIPA; when, because other conversations in the sale room might also be recorded, this had to be RIPA authorised. Another point is that many Authorities have been obtaining RIPA authorisations on a precautionary basis for activities that do not require it: this includes underage test purchases, photographing/filming dog-fouling and, quite probably, the surveillance of the 3 families in Poole (2 of whom were caught out cheating). Also note that the media claims of phone-tapping are nonsense. There will have been a very few applications for the equivalent of itemised bills, but all the others will be for reverse directory information under the powers of the Trade Descriptions Act or similar legislation —Preceding unsigned comment added by 86.27.165.198 (talk) 09:57, 27 June 2008 (UTC)

Your claims of previous surveillance activity and bad reporting by the media is interesting, but you will need to provide a reliable source for Wikipedia to verify the facts. Road Wizard (talk) 18:08, 27 June 2008 (UTC)

Link to the act "currently in force" - no such thing exists at present

The link to the statute law database is absolutely NOT the current amended version- as far as I am aware, no fully amended version exists. I can speak mainly from the perspective of disclosure of communications data (Part 1, section 2), but I have looked into this at great length. The version linked to is (as far as I'm aware) exactly the same text as the link to the "original text".

The number of changes made to the actual text over the past 8 years are relatively infrequent, coming notably in 2003, 2005 and 2006, but the major changes have been in the list of Authorities, which was significantly expanded in 2003 and 2006, and altered by Myriad other acts which involved the creation/deletion/merging of authorities (e.g. HMRC, SOCA). The text linked to contains none of these changes, and thus is being mis-represented. (N.B. "Authority" ="type of agency" - RIPA mostly just specifies classes of agency, e.g. "A UK council" rather than naming specific agencies)

By way of evidence, please see the "Update Status Warning" on The Act itself, the page showing some of the Amendments to the act, and the interface through which you can find primary and secondary legislation which has modified the act:RIPA- Tables of legislative effects.
How should this matter proceed? I'm sure there are people there much better equipped to progress this than I. (Leveret)82.22.6.4 (talk) 22:16, 23 March 2009 (UTC)

Prosceutions under RIPA

I've tried to confirm the case of the chap jailed for refusing to hand over his encryption keys & can find no references outside one website and 'reprint' of that article. Whoever posted this in the first place, please reference the case properly or remove it...

Tattooed Librarian 11:12, 17 November 2010 (UTC)

Here is a reference. This case was extremely well reported and it's not hard to find references, googling for "Oliver Drage" will turn up hundreds.

Amoe (talk) 13:25, 14 December 2010 (UTC)

The link you provide refers to Oliver Drage. The first person jailed under RIPA was (according to the page reference) a UK :schizophrenic, referred to as 'JFL'.

Drage is a different case - he was a 19 y/o being investigated for alleged child sexual exploitation.

I still can't find a unique reference to the JFL case, other than 'The Register' and 'repeats' in blogs - maybe you can assist.

In the mean time, thanks for the 'Drage' reference - I've updated the main article to include this - it gives good balance.

Tattooed Librarian (talk) 15:17, 14 December 2010 (UTC)

Thanks for this! Amoe (talk) 18:58, 14 December 2010 (UTC)

ISTM that the phrase "child exploitation" is just being used here as a euphamism for child porn; why not call a spade a spade?

Assuming he was storing that kind of material, it would certainly drive home more effectivly the point about how apparently impotent the police/CPS are at investigating/prosecuting material which has been encrypted, and the punative nature of the RIPA for anyone refusing to co-operate in an investigation against them. Four months sounds "cheap" compared with what he could probably have expected had he obeyed the order to decrypt it.

OTOH, given that there's no evidence that he was in fact storing such material, perhaps the reference to "child exploitation" should be removed from the article on the basis it's not relevant and is purely speculative? From the references, it had no bearing on his prosecution and subsequent sentencing?

Nuwewsco (talk) 00:34, 15 December 2010 (UTC)

Unless I'm missing something, it's not up to editors to 'drive a point home' about anything. This is an article about RIPA, not about the police's ability to investigate certain types of case. The only relevance that 'ability' has is to say that for all other types of evidence seized (lawfully, with a search warrant or s.18 powers) the contents are obvious to all (such as paper records etc.). In the case of an encrypted computer, that is not so - the suspect can defeat a lawful search warrant. The offence is there to prevent people from doing this, by hiding potentially criminal materials behind a strong password, and both cases show this.

The reference to 'child exploitation' in the second case is not speculative - he was part of that investigation and that led to the request to provide the password - that is a factual reference to the circumstances that led to that request being made in that specific case.

Tattooed Librarian (talk) 14:06, 15 December 2010 (UTC)

Oliver Drage

Did Oliver Drage ever get out of prison? I know he was sentenced for 4 months, but there seemed to be the possibility that they would throw him back in jail again if he still refused to give out the password. —Preceding unsigned comment added by 71.194.190.179 (talk) 23:13, 4 March 2011 (UTC)

Neutrality

The summary of this article doesn't really meet NPOV guidelines — Preceding unsigned comment added by Jdraymon (talk • contribs) 23:11, 13 September 2012 (UTC)

Couldn't agree more - full of inaccuracies and very slanted. Anyone got the time for a full rewrite? Tattooed Librarian 13:47, 14 September 2012 (UTC) — Preceding unsigned comment added by TattooedLibrarian (talk • contribs)