RIPA Part III

[Caspar Bowden]

[The contents of this e-mail may attract comment from retired military
intelligence officers. No liability is accepted for consequential
flummery, persiflage and logic-chopping which may arrive in your Inbox]

From: Watkin Simon <Simon.Watkin@homeoffice.gsi.gov.uk>
Via >>admin@chiark.greenend.org.uk] On Behalf Of Peter Fairbrother
...
>And Part III is not extra-territorial, so a notice cannot be enforced
>outside the UK. =20

But can a notice be drawn up waiting to be served on a person if they
step into the UK? [Nothing wrong with that if you believe in S.49
notices, but it might alarm visitors]

>No one is saying people can't keep secrets from the Government.  People
can
>keep their secrets, but if the secret is about something harmful to
>society, or is believed to be something like that, we're saying that in

>accordance with the law people with such secrets will have to disclose
just >what it is they are keeping secret or how they keep that secret.

Yes. People have the right to keep secrets and the state has a right to
try to find out what they are, subject to the rule of law.

>If my secret is abusing my niece, is that a secret I should keep from
>Government? =20

If one parses that as "should the individual have the right to withhold
evidence of that", the answer is No.

>I may want to keep that secret but should the law which seeks
>to punish me for the abuse protect my secret.

The point is that encryption and its relationship to other technology
aren't the same as it ever was. The government appears to be afraid that
people will become accustomed to encryption technology, so very early
made policy as if this was a bad, dangerous, tricky, exotic,
unreasonable and suspect thing.

How will use of encryption evolve over next 10 years? The basic
assumptions must be that:

- more people will understand how to do it; it will be more widely used
- it will become more necessary and important for the individual's
self-protection and information self-determination (i.e. controlling
what others' know about you so you can take partial responsibility for,
and limit economic and criminal risks arising from, personal data)

This is a much wider agenda that the few number of cases that will arise
under RIP Pt.3. But as Lord Lloyd points out
http://www.timesonline.co.uk/article/0,,2-2217745,00.html its not the
number of times powers are applied that makes them OK or not OK. We
should all be very worried indeed when the first Interception
Commissioner, who for past 20 years had a ringside seat on anti-terror
law, starts using words like "sinister" about current policy.

However it is entirely probable, as the next generation grows up using
computers in the UK, they will do so with an attitude substantially
different from anywhere else in the civilized world. People will always
know they are "on notice" to unlock any data in their possession, no
funny business, else the threat of a summary conviction by the state
will always loom (and who knows what else to be enacted in future panics
as RIP Pt.3 slowly fails). It will be like living in a 50s prep school,
but with electronic prefects.

Watching John Gieve give evidence to HA Sel Ctee, I suspect part of the
problem in Home Office policymaking is that to the upper echelons this
sounds like a jolly good idea.

I genuinely fear what effect that will have on the nature of British
society.

"But people love CCTV" I hear you say. They do - so far, and so long as
it hasn't been digitized and indexed. It's quite possible for democracy
to have many trajectories of evolution, at each stage legitimate, but
some paths lead to a horrible place and others not. RIP Pt.3 is part of
an agenda (a major part - but not yet significant) to construct what
even the mild-mannered UK Information Commissioner calls a Surveillance
Society. For many of us on this list, that is a horrible place, and we
don't wish to live in that society.

>Murder and robbery, and let throw in child abuse, are crimes
>and they hurt people. If the evidence of those crimes is protected
should
>law enforcement just walk away?  No.

No. You investigate with such tools as are consistent with human rights,
inventing new ones if need be. You don't lurch towards a path of least
resistance whose main attraction is that although it screws everyone's
freedom, only nerds immediately realize what it's about and will
complain.

>If we can make it a requirement that is used appropriately, only
>necessarily and never unnecessarily, only proportionately=20

Define proportionately in this context, preferably without resorting to
the circular formula of relation to what is sought to be achieved.=20

>and never unfairly or arbitrarily,=20

And please can we also have a law telling government always to be good
and wise, and for that law never to be broken, but if it is all
infractions will be detected and justice done.

>and make that requirement
>enforceable by law, as we do with requirements to give breath samples
at >the roadside, that is surely in the best interest of the public in
order to >deal with those individuals who hurt people.

I would like to propose an analogy ban (and cf.
http://blogs.msdn.com/michael_howard/archive/2006/03/09/547575.aspx)

Encryption isn't quite like anything else, so let's stop pretending it
is.
If we want to make a simile or a metaphor, fine, but let's not argue as
if some partially analogous resemblance to an existing situation
self-evidently settles some policy or legal question.

--
Caspar Bowden