Minister promises that Part III is coming
Richard Clayton
ukcrypto at chiark.greenend.org.uk
Thu, 11 May 2006 18:41:42 +0100
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
There was a mini-debate in the Commons yesterday about changing the
sentence for RIP Part III offences when the encrypted material ...
only the encryption related stuff has been left in below. It's still
rather long, apologies.
If you don't read it all -- the important bit is that the Minister has
now promised Parliament that he will turn on Part III of RIP after a
Real Soon Now consultation....
<URL:http://www.publications.parliament.uk/pa/cm200506/cmhansrd/cm060510
/debtext/60510-0010.htm>
Hansard 10 May 2006 Column 379 et seq
Proposed amendment:
(1) The Regulation of Investigatory Powers Act 2000 (c. 23) is amended
as follows.
(2) In section 53 (failure to comply with a notice)-
(a) after subsection (5A)(a) there is inserted-
(aa) in a case to which subsection (6) applies, seven years;-
(b) after subsection (5B) there is inserted-
(6) This subsection applies where-
(a) a person has been previously convicted of an offence contrary to
section 1 of the Protection of Children Act 1978 (c. 37) or section
160 of the Criminal Justice Act 1988 (c. 33); or
(b) the apparatus or data storage device containing the protected
information contains an indecent photograph or pseudo-photograph of
a child; or
(c) the apparatus or data storage device containing the protected
information has come into the possession of any person together with
other apparatus or a data storage device which contains an indecent
photograph or pseudo-photograph of a child; or
(d) the court is satisfied that the protected information is likely
to contain an indecent photograph or pseudo-photograph of a child.
(7) Subsection (b) will not apply where the person to whom the
notice is given can show that the protected information does not
contain an indecent photograph or pseudo-photograph of a child.
(8) In this section 'indecent photograph or pseudo-photograph of a
child' shall have the same meaning as that set out in the Protection
of Children Act 1978 (c. 37).
Sir Paul Beresford (Mole Valley) (Con):
[snip]
Many of the images are in the form of videos or DVDs or are on
computers. Increasingly, they are kept on remote storage. Some of the
computers that the police collect have no hard drives at all. They are
driven or initiated by a disk and the information is stored remotely.
Increasingly, the information is hidden by encryption. We used to have
simple encryption, but we have moved to 128 bit and, even more, to 256
bit encryption. The software is freely available on the internet and
relatively easy to use. Essentially, it is unbreakable.
The other thing that particularly alarms me is that Vista, which is the
replacement for Windows OS, is due out generally next year. Once that
system is on board the security is such that, when the computer is
turned off, it automatically encrypts all the information on it so that
when the police collect the computer and turn it on, they cannot break
through the encryption. Some information can be destroyed, preventing
access by the police. The police clearly need access for obvious
reasons. They need to seek evidence against individuals and, frequently
- -- because offenders sometimes work in packs or groups -- against
others. In a way, perhaps it is even more important that the police can
identify the children in the photographs and movies. Once those
children have been located, it is possible to seek care and counselling
for them to try to bring them back into a normal life. There is some
evidence that abused children go on to become abusers themselves.
The new clause deals with encrypted data found on computers and storage
in cases where the police believe that the encrypted data contains
abusive images of children. It does not create any new offence or
scheme, but rather amends the sentencing regime under section 53 of the
Regulation of Investigatory Powers Act 2000, which is commonly known as
RIPA. Part III requires a person to comply with a notice issued by the
police to hand over the encryption key for protected data. The penalty
for a breach is two years, but that is ludicrous for a paedophile
because the alternative penalty, if the information was turned over,
would often be five years or more and, frequently, having to go on the
sex offenders list. Accordingly, it is unlikely that an offender who has
indecent and abusive photographs of children on his computer would
comply with the notice. To achieve compliance, we need to step up the
penalty, so I suggest that such offenders should be liable for up to 10
years' imprisonment, which is the penalty for contravening section 1 of
the Protection of Children Act 1978 -- there is thinking and a link
behind the idea.
The new clause would simply raise the sentence if a court was satisfied
that it was more than likely that the majority of the encrypted data
consisted of indecent photographs of children. I suggest that the civil
burden is permissible because the offence would be not possessing the
photographs of children, which would be punished separately, but the
failure to hand over the key. The higher sentence would apply only when
one of two thresholds was passed: first, that the computer had non-
encrypted indecent photos of children or a child on it, as an
indication; or, secondly, that the person had been previously convicted
of an offence contrary to section 1 of the Protection of Children Act
1978 or section 160 of the Criminal Justice Act 1988.
[snip rest of speech + other contributions]
Mr. Byrne (brand new minister, Labour):
I would like to deal now with new clause 2, the ambitions of which are
welcome. As the hon. Member for Mole Valley explained, the new clause is
designed to increase the maximum penalty for an offence under section 53
of the Regulation of Investigatory Powers Act 2000, which is failing to
comply with a requirement to disclose protected information or the key
to it. The increase in the maximum penalty would apply in the
circumstances set out in new subsection (6) of section 53 of RlPA,
including where the offender has a previous conviction for possession of
indecent images of a child.
The use of encryption is, as the hon. Member for Mole Valley pointed
out, proliferating. Encryption products are more widely available and
are integrated as security features in standard operating systems, so
the Government have concluded that it is now right to implement the
provisions of part 3 of RIPA, including section 53, which is not
presently in force.
The threat to public safety posed by terrorist use of encryption
technology was recognised in section 15 of the Terrorism Act 2006, which
increased the maximum penalty for the section 53 offence to five years
in a national security case. The Government will therefore publish for
consultation a draft statutory code of practice for the investigation of
protected electronic data and the exercise of powers in part 3 of RIPA.
We have previously given an undertaking to bring forward proposals in
line with new clause 2 in the context of consulting on the
implementation of part 3, and we shall shortly begin those
consultations. We remain very sympathetic to what the new clause is
designed to do, but we want to allow an opportunity for public
consideration and comment on the proposals first, before implementing
any legislative changes.
[snip snip]
In the light of those comments, I hope that my assurances will provide
sufficient comfort for hon. Members to agree to withdraw the motion but
to work with us on implementing their ambitions.
Bob Spink: I am grateful to the Minister for considering the amendments.
I beg to ask leave to withdraw the motion.
Motion and clause, by leave, withdrawn.
- --
richard Richard Clayton
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755
-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1
iQA/AwUBRGN3VpoAxkTY1oPiEQKZrwCdHau7KVlsZ7chLCda262T8IibwyIAoI/S
xsgyUClTRwi7iuNqBxTCx8S6
=gKnL
-----END PGP SIGNATURE-----