Striking the Right Balance between Privacy and Public Protection

[Dave Bird]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In article <LU0xz+JCoQv9EAF2@highwayman.com>, Richard Clayton
<richard@highwayman.com> writes
>In article <GQ9TxKCvFXu9Ewsa@xemu.demon.co.uk>, Dave Bird
><dave@xemu.demon.co.uk> writes
>
>[snip discussion of the difficulty of disclosing any substantive
>information in a notice to a third party because of defamation risks]
>
>> This might actually mean the notice couldn't say why, but
>> merely "A criminal complaint was investigated against someone
>> you were in contact with.  Either no charges were made or
>> the prosecution failed.  We believe we had sufficient probable
>> cause to investigate this alleged offence and that the investigations 
>> we made were necessary, proportionate, and relevant, including 
>> investigation of his communications to you."
>>
>> It would still reveal what surveillance was done, and when.
>
>But my point is that all you have is the assurance of the police that
>there was indeed "sufficient probable cause" and that the "necessary,
>proportionate and relevant" tests were met.
>
>The tone of many recent contributions has been that assurances from the
>police should not always be taken at face value.
>So this does not of itself give any oversight.

 I believe it was you who raised the possibility that notice
 describing a failed investigation of a third party might itself
 compromise his rights if it gave his name without his permission;
 if that were so, then the response would be that notices did not
 disclose the third party's details in such circumstances. 
 
>
>> For the rest it might have to say "if you wish to know more
>> about this including the offender's name, then we will forward
>> your request to him but he is not forced to answer you."
>
>That's an interesting idea ... though if the investigated person didn't
>want to discuss it then the oversight is no further forward.
>
>> This still allows the person who is outraged by a false
>> investigation to get together with his associates they
>> investigated so as to make a joint complaint.  But if
>> the suspect wants his own privacy then you get no further
>> with that aspect of it.  
>
>Of course if you get together with others then by cross-correlating who
>has or has not received a notice then you may well be able to deduce who
>was investigated (even though their name was withheld).
>
>I still feel that there's some way to go before one can say that
>"telling people after the fact that their privacy was invaded so that
>that there is oversight of the procedures" meets the rather important
>test of practicality :(  [let alone, since about a million such notices
>would be issued a year, scaleability]

 Well, the TelCos manage to issue a great many more bills than that;
 perhaps the police could pay the TelCo to send such notices out.
>
>However, it is apparently the scheme in The Netherlands (albeit for the
>rather more serious (and lower volume) privacy invasion of actual
>interception); so it must be possible to make it work !

 I think you need at least the following safeguards combined:

 (1) A limited number of agencies can do this, and they are licensed
 by police that they meet the standards required. Requests are done
 in a disciplined and efficient way between specific nominated people
 at the police or other requesting agency, and the TelCo / ISP.
>
 (2) Reverse directory lookups are done similarly to PNC look-ups 
 of vehicle registration numbers, they are similar in seriousness 
 and have to combine good control with high volume.  Orders to
 intercept traffic or content are more serious, comparable with
 search warrants. 

 (3) Prevention of abuse [which may be for criminal reasons and be
 used for threats or harassment] is better than cure; the discipline
 of use comes first. This should be monitored by two forms of
 disclosure, in deatil to persons affected, and giving overall
 numbers to the public.

- -- 
   ^-^-^-@@-^-;-^   http://www.xemu.demon.co.uk/
        (..)__u     news:alt.smoking.mooses

       happy as a clam at high tide -. <_" .-._.-.


-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1

iQA/AwUBPb2hPnpGxv7MBb4WEQKt1QCeMCUckVMdTb0bt6zrM+t/jDRp89QAoIYJ
9q2I+IC6p+1mg+LQhXeMwgGE
=Aeqe
-----END PGP SIGNATURE-----