Joint Committee on The Draft Communications Bill Appendices to the Minutes of Evidence


APPENDIX 82

Supplementary memorandum submitted by the Home Office

  This memorandum is submitted by the Home Office in response to the request from the Chair to the Joint Committee on the draft Communications Bill to the Secretary of State for the Home Department, requesting answers to questions relating to the impact on telecommunications operators of legislation for which the Home Office has policy responsibility, including the Regulation of Investigatory Powers Act (RIPA) and the Anti-terrorism, Crime and Security Act (ATCSA). In particular the Committee wished to receive information about the regulatory requirements imposed by these Acts on telecommunications operators and the extent, if any, to which these requirements are co-ordinated with those imposed by Oftel and, in the future, by OFCOM.

  Attached at Annexes 1 and 2 are the Regulatory Impact Assessments for Part I and Part III of RIPA, which were laid before Parliament at the time of the passage of the Bill. These have not changed significantly and money has been set aside by the government to help industry meet the cost of the measures in the Act.

  Part I of RIPA provides powers (section 11) to ensure that when a provider of public postal or telecommunications services is asked to carry out a specific interception there is a duty on them to take reasonably practicable steps to comply. The Act also contains powers (section 12) to ensure that such providers are capable of carrying out the lawful interception of communications.

  Interception of communications by UK law enforcement agencies is lawful only when the Secretary of State is satisfied that it is necessary on one of the limited grounds set out in the Act and that its use is proportionate in what is sought to be achieved, and authorises it personally by warrant.

  Section 12 provides that the Secretary of State may, by notice, require a Communications Service Provider (CSP) to maintain an interception capability and meet obligations provided for by an Order (Section 12(2)). The draft Regulation of Investigatory Powers (Maintenance of Interception Capability) Order 2002 was laid before Parliament on 22 May. The order requires affirmative resolution and was debated in Standing Committee on 18 June and was approved. A copy of the Order is attached at Annex 3.

  The Schedule to the Order lists those obligations which appear to the Secretary of State reasonable to impose on CSPs for the purpose of securing that it is practicable for them to meet requirements to provide assistance in relation to interception warrants. For the purpose of the Order interception of communications means the interception of a communication in the course of its transmission by means of a postal service or telecommunications system. The obligations in Part I of the Schedule will apply to CSPs who provide, or propose to provide, a public postal service. The obligations in Part II of the Schedule will apply, subject to paragraph 2(3) of the Order, to CSPs who provide, or propose to provide, a public telecommunications service.

  The draft Order has been the subject of lengthy public consultation (from December 2000 to August 2001) and extensive dialogue between government and industry. A draft copy of the Order has also been considered by the European Commission in accordance with European Transparency Directive 98/34/EC.

  It is the government's intention that a Notice given to a CSP under Section 12 will, wherever possible, be the product of prior dialogue and agreement between the government's representatives and the CSP in question. However, should a CSP consider that a Notice given to it is unreasonable, either in terms of the steps it requires the CSP to take in order to meet the obligations in the notice or in terms of the financial consequences of these steps, the CSP may refer the Notice to the Technical Advisory Board, which has been set up under Section 13 of RIPA. The duties of the TAB are to consider the technical requirements and the financial consequences of a Notice on the CSP to which it is given. The TAB must report its findings to the Secretary of State and to the CSP. The Secretary of State, after considering the report of the TAB may either withdraw the Notice or issue a further Notice with or without modifications.

  Oftel was consulted on a regular basis both during the policy formulation and development which led to the Act and during the passage of the Act through Parliament. The Home office continues to consult Oftel as and when necessary on interception issues and intends to do the same with OFCOM.

  Section 14(2) of RIPA places a duty on the Secretary of State to ensure that arrangements are in force for securing that CSPs receive a fair contribution to the costs incurred as a consequence of both the imposition of obligations provided for by a Section 12 Order and the invocation of interception warrants. At present the government has arrangements in place with all those CSPs currently providing interception and pays a substantial contribution to the costs they incur.

  The government intends to continue with the existing agreements at least until the end of this financial year, when it will seek to put in place a new regime which will more closely identify those costs arising from warrant invocation and those arising from the maintenance of an interception capability. In developing a new costing regime, considerable assistance and transparency will be needed from industry. To this end, officials have begun to consult widely on this issue.

  Part III of RIPA deals with the provision of plain text documents and specifically with release of encryption keys to the law enforcement agencies. The Regulatory Impact Assessment (RIA) on this part of the Act was made in December of 1999 and is attached. A Code of Practice is about to be published for public consultation. It has been widely discussed since March of 2001 with CSPs and the Agencies. On the basis of those discussions we remain of the view that the estimates in the RIA are still well founded.

  Issues of encryption have been subject of discussion between the Home Office, Oftel and the industry. The Performance and Innovation Unit (PIU) Report on Encryption & Law Enforcement of 1999 highlighted the need for a Government Industry Forum. As a result of this recommendation a Forum now meets and includes members from Oftel. It is intended that in due course this Forum will include OFCOM.

  The Government intends that the industry will be recompensed for costs incurred in delivery of any keys required.

  Part II of the Anti Terrorism Crime & Security Act (ATCSA) provides for the drawing up of a voluntary code of practice between the Government and the telecoms industry. The purpose of the code will be to establish what data will be retained by the industry for the purpose of safeguarding national security or the prevention or detection of crime or the prosecution of offenders which may relate directly or indirectly to national security, and for what period.

  Discussions have been taking place with members of the industry and the Agencies to try to establish mutually acceptable solutions on these issues.

  At present, CSPs are only authorised to retain communications data for the period which is required by their own business purposes. This means that data which is relevant to national security or criminal investigations may be erased or anonymised before the need for it can be identified. Technical differences between telecommunications systems and commercial pressures to minimise retention have also led to wide variations in retention policies across industry.

  New communications services such as "unlimited calls", "pre-pay" and "always on" may mean that traditional retention may not take place at all. All this means an increasing risk that criminals may escape detection and prosecution according to which network or package they use for their communications.

  It is important we carefully balance the needs of law enforcement against the need to protect privacy and the impact of any new rules on industry and the single market. The consultation process will deliver the technical specification that will accompany the voluntary code.

  Chapter II Part I of RIPA is the medium by which access to communications data is obtained. RIPA does not alter the present situation it outlines those Public Authorities that may under the Act request access to such communications data. It places a duty on the part of the telecommunications operator, who may be in possession or capable of obtaining any communications data to comply with the requirements of the notice served by the public authority. It also places a duty on the Secretary of State to ensure that arrangements are in force, as he thinks appropriate, for the making of appropriate contributions towards the cost incurred by the telecommunications operators in complying with any notices under the provisions of Chapter II Part I of RIPA.

  Data retention will be discussed at the next Government Industry Forum to take place on 28 June 2002. Oftel will be represented at that Forum and it is hoped that OFCOM will accept a similar position in the future.

Annex 1

Regulatory Impact Assessment

REGULATION OF INVESTIGATORY POWERS BILL: PART I.

LEGISLATIVE PROPOSALS FOR THE INTERCEPTION OF COMMUNICATIONS

1. TITLE

  Provision of a reasonable interception capability, and of reasonable assistance in giving effect to interception warrants.

2.  PURPOSE AND INTENDED EFFECT OF THE MEASURE

(i) Issue and Objective

  Issue: The Interception of Communications Act 1985 (IOCA) was introduced in order to provide a comprehensive framework for interception. It applies to the interception of all communications on the United Kingdom's postal or public telecommunications systems conveyed by the Post Office, British Telecom and any other public telecommunications operator licensed under the Telecommunications Act 1984. At the time the legislation was passed, this definition encompassed all known methods of communicating by public networks and attempted to provide for future developments.

  The last 15 years have seen tremendous changes taking place in the communications industries in the United Kingdom. This has meant that the existing legislation, and in particular its narrow scope, have become rapidly out of date.

  Objective: The objective is for the Secretary of State to be able to issue legally binding requirements on any Communications Service Provider ("CSP", such as public telecommunications operators, postal carriers, internet service providers and international simple resale providers) for the maintenance of a reasonable interception capability in respect of their publicly available communications services. The Bill leaves open the question of how the cost for this should be allocated. In addition, any person or organisation named on the schedule to an interception warrant, including CSPs, should be under a legal obligation to provide reasonable assistance in order to give effect to the warrant.

  The intention behind this objective is to maintain, as far as possible, the effectiveness of the current Act on which the law enforcement, security and intelligence agencies rely in combating serious crime and threats to national security, by extending its scope to all CSPs.

(ii) Risk Assessment

  Without the new powers, there is a risk that any criminally minded individual could use a service provided by a CSP which is outside the scope of the current Act, thereby making it considerably more difficult, if not impossible, for law enforcement to intercept his communications. The risk is extremely difficult to quantify but, as an illustration, and at the top end of the scale, lawful interception of communications played a part—often the crucial part—in operations by police and HM Customs during 1996 and 1997 which led to:

    —  1,200 arrests;

    —  the seizure of drugs with a street value of over £600 million;

    —  the seizure of over 450 firearms.

  These successes would have been in jeopardy had the criminals used networks which fall outside the scope of the current Act's warranty regime, because there is no requirement for the providers of such networks to have an interception capability.

3. OPTIONS

  Three options have been identified:

    Option 1:  Rely on existing powers.

    Option 2:  Extend the scope to include all CSPs, with an obligation to provide reasonable assistance but with no obligation to provide a reasonable intercept capability.

    Option 3:  Extend the scope to include all CSPs, with an obligation to provide both a reasonable intercept capability with respect to their publicly available services and reasonable assistance in giving effect to interception warrants.

Issues of Equity and Fairness

  None of the identified options would seem likely to discriminate against any particular element of society.

  The proposed requirements in the Bill (Option 3) have been met by Public Telecommunications Operators and the Post Office since IOCA came into force in 1985, but not by other CSPs who were either not in existence or very small players in 1985 and who are therefore outside the legislation's scope. It could be argued that imposing similar requirements on all CSPs within the UK will contribute towards ensuring a fair and level commercial playing field, placing no one section of the UK's communications industry at a disadvantage when operating at home or internationally.

4.  BENEFITS

Option 1—Rely on existing powers

  The benefits in relying on existing powers would lie in the unfettered way in which communications industries outside the current scope, and in particular the Internet industry, could develop their services. This option would offer no benefits to law enforcement.

Option 2—Extend the scope, with no obligation to build in capability

  This option would also be welcomed by those providers currently outside the legislation's scope. And an extension to the scope, requiring CSPs to provide assistance, would be of some benefit to law enforcement. However, were such providers to make no provision for interception on their networks, it could prove difficult or even impossible for an interception warrant to be given effect within the necessary time-scale, even with the full assistance of the provider concerned. Such a capability would have to be developed from scratch by the agency on whom the warrant had been served, and the cost would be much higher than if capability had been designed in from the start. This option would also put those CSPs who have built an interception capability into their systems at a competitive disadvantage.

Option 3—Extend the scope, with an obligation to build in capability

  Obliging all CSPs to provide and maintain a reasonable interception capability with regard to their publicly available services best answers the intention outlined at Section 2 above, of maintaining the effectiveness of the current Act in combating serious crime and threats to national security.

Quantifying and Valuing the Benefits

  The key intention—combating serious crime and threats to national security—is highly valued but notoriously difficult to quantify. The relative merits of the three options in quantitative terms, then, are not easy to pin down.

  However, the figures at Section 2 above give an indication of the potential drawbacks of Option 1. All these successes would be in jeopardy.

  Option 2 would help to mitigate these drawbacks, but only to a very limited extent. Many of those CSPs currently outside the scope of IOCA already provide assistance to law enforcement.

  Option 3 should enable the successes outlined at Section 2 to continue. Interception represents an extremely high value for money method of investigation for law enforcement, yielding accurate and up to date intelligence for relatively little cost. To take the example of drugs, the following figures give some indication of the technique's importance.

  In 1998 the Government spent £1.4 billion tackling the drugs problem[89], including around £420 million on law enforcement activity and £170 million on health services. In addition, 50-70 per cent of the estimated £1.5 billion spent per annum on drugs by users is raised through acquisitive crime. The cost to victims of this crime, much of which involves shoplifting and burglary from commercial premises, could be three to five times higher[90]. This gives a cost to victims of in the region of £3.5 billion.

  In addition, money lost to the Exchequer in lost revenues is estimated to be £220 million per annum for alcohol smuggling and £1.7 billion for tobacco smuggling[91]. These figures yield a total cost to the country of £6.8 billion per annum.

  During a 12 month period during 1998-1999 Customs seized 1.25 tonnes of Class A drugs, and made 93 arrests in connection with those drugs, through interception. In fact, in 1998 52 per cent of the total amount of heroin seized by Customs was a direct result of interception; and the total value of drugs seized in 1998 as a result of interception was in excess of £185 million. This comes to over 10 per cent of the total sum spent on drugs per annum in the UK, an amount which could cost the country up to £500 million each year. Meanwhile, in work against alcohol and tobacco smuggling, recent Customs interception operations have been sufficiently successful that the number of staff working on interception against these targets has doubled.

  Further details of the benefits of interception are provided in a confidential annex to this document.

5.  COMPLIANCE COSTS FOR BUSINESS, CHARITIES AND VOLUNTARY ORGANISATIONS

(i) Business Sectors Affected

  The legislative proposals affect four key business sectors: public telecommunications operators; international simple voice resale providers; internet service providers; and postal carriers. Given the rapid development of technology since IOCA was enacted, it is expected that other groups will be affected in the longer term as new innovations are introduced into the communications marketplace.

  Public telecommunications operators are licensed under Sections 7 and 8 of the Telecommunications Act 1984, and their systems designated as public telecommunication systems under section 9. They include some cable companies and mobile operators. In total they number around 40. They are subject to the current Act, and already provide a reasonable interception capability.

  International simple voice resale providers (ISVRs) are licensed under Section 7 of the Telecommunications Act, and buy bulk international line space from PTOs to resell the calls. 233 were licensed by the DTI as of July 1999. In most cases it is expected that such providers will not need to be involved in the effecting of interception warrants; this will be done by the PTO providing the network which the ISVR is using.



  Internet service providers (ISPs) are also licensed under Section 7 of the Telecommunications Act. The Internet Service Providers Association lists around 80 members, although not all of these are ISPs; and the London Internet Exchange lists 82. In total there are now over 300 operating in the UK.

  Postal carriers fall into two separate categories. The first, operated by the Post Office, is already subject to the Act and should see little change. The second comprises all those mail carriers and couriers which offer publicly available services. Where the destination or origin of mail or parcels is overseas, or transportation involves carriage by air, carriers are already subject to Customs and Aviation regulations.

(ii) Compliance Costs

  Option 1 would not result in any additional costs to business since there would be no changes to current practices. Option 2 would represent a small additional cost to those CSPs currently outside the Act, in terms of the manpower, training and physical costs associated with providing reasonable assistance to an intercepting agency.

  Option 3 would require some CSPs to provide an interception capability for the first time; for others it would make no change to the status quo. Compliance costs would vary on a case to case basis, and are extremely difficult to predict. For example, equipment used for interception could also be used for other purposes, such as the prevention of fraud on the network. However, some key factors for each business sector are outlined below:

  Public Telecommunications Operators: It is not expected that Option 3 would impose any significant additional cost on this business sector. Precise costs for the capability already provided are hard to calculate, because interception capability was just one of a number of requirements specified to manufacturers when switching and other equipment was purchased. However, a rough estimate might suggest that the capital cost per year plus annual running costs for equipment and staff could be up to 0.03 per cent of turnover. Specific figures are subject to commercial sensitivities.

  International Simple Voice Resale Providers: Again, Option 3 should have a minimal impact on this business sector.

  Internet Service Providers: Option 3 would represent a significant additional cost in some cases. At this stage precise costs are hard to calculate: discussions with businesses are progressing, but negotiations with regard to requirements and cost allocation are at an early stage. The industry itself has stated that it is currently too early to give a clear idea of the costs involved.

  Internet access services are increasingly offered to the public by companies other than traditional telecommunications operators; for example, retail chains and broadcasting companies. However, although the capability and assistance requirements will fall on some of these providers, in practice these will be the responsibility of those who operate the system on which the service runs. As stated above, the Bill leaves open the question of cost allocation. Any costs falling on industry are likely to have some impact on these new providers.

  Postal Carriers: Those carriers who responded to the consultation exercise stated that they already have an interception capability, and that any costs imposed by Option 3 would therefore be very small.

(iii) Total Compliance Costs

  Total compliance costs in the short terms are not expected to exceed the measure of significance (£20 million) used by the Regulatory Impact Unit of the Cabinet Office. More details are commercially and operationally sensitive, and are therefore included in a confidential annex to this document. However, an indication of the scale of interception carried out in response to warrants can be taken from the number of warrants issued each year. The following statistics are presented in line with the practice of the Interception Commissioner:

1993-1998 Warrants for Interception[92]

(FIGURES IN BOLD REPRESENT THOSE WARRANTS LEFT IN PLACE AT THE END OF THE YEAR.)
Year  Home Secretary   Secretary of   State for Scotland
1992874337 9227
1993998372 12237
1994947359 10037
1995997405 13872
19961,142477 22863
19971,456460 25638
19982,031487 26854

6.  RESULTS OF CONSULTATIONS

  The Government's consultation document "The Interception of Communications in the United Kingdom" was published on 22 June. It proposed that the scope of the existing legislation be extended, and that CSPs be required to provide a reasonable intercept capability with regard to those networks they operated which were publicly available (ie Option 3).

  In total 85 responses to the document were received, fairly equally divided between government, industry and other interests. There was a general recognition that the Interception of Communications Act 1985 did need updating, but that in principle the interception of communications was justifiable where it was done for clearly defined purposes and with proper safeguards in place.

  Nearly all respondents also conceded that the scope of the legislation should be extended to cover all CSPs providing publicly available services: this proposal was particularly welcomed by the law enforcement community, and by those providers already subject to IOCA. However, there was less agreement about how to allocate the costs this extension in scope would involve. Those responses where permission to publish was not withheld—and a summary of all responses—are available from the Home Office website at www.homeoffice.gov.uk/oicd/conslist2.htm.

7.  SUMMARY AND RECOMMENDATIONS

  Following Option 1 is not realistic. It is essential that the scope of the interception legislation be extended, if existing powers are not to be seriously degraded by the growth of new technology.

  Option 2 would involve an extension in scope, which would be of benefit insofar as intercepting agencies could require reasonable assistance from the CSP concerned. However, were such providers to make no provision for interception on their networks, it could prove difficult or even impossible for an interception warrant to be given effect within the necessary time-scale, even with the full assistance of the provider concerned. Such a capability would have to be developed from scratch by the agency on which the warrant had been served. This option would also put those CSPs who have built an interception capability into their systems at a disadvantage.

  Option 3, which proposes an extension in scope and corresponding requirement on CSPs to provide a reasonable interception capability, has therefore been identified as the most appropriate way forward. This option will entail cost to some sectors of the communication provider industry, substantial in some cases. But this must be set against the wider costs to society that would accrue from allowing the use of communications technologies effectively inaccessible to law enforcement to undermine their ability to detect and prevent serious crime and threats to national security. Option 3 is also considered to be the most effective option for ensuring a level commercial playing field for all CSPs in the UK.

  Maintenance of an interception capability forms a requirement for CSPs in countries where these providers are in commercial competition with the UK, both in Europe and globally, including such countries as France, Germany, the Netherlands, Sweden, Canada, the USA and Australia.

8.  ENFORCEMENT, SANCTIONS, MONITORING AND REVIEW

  All warrants for interception are personally and expressly authorised by the Secretary of State. Following devolution, the function of authorising interception warrants in respect of serious crime targets located in Scotland has been executively devolved to Scottish Ministers. It is proposed to introduce an offence of "tipping off" another person that a warrant has been served, or telling them of its content. There will be statutory defences. Further, the Bill will introduce a civil liability in respect of a failure to comply with the requirement to provide a reasonable intercept capability or reasonable assistance in giving effect to an interception warrant.

  Although it will be for the Secretary of State to decide what constitutes a reasonable capability, he cannot do so unless the Order identifying the requirement is laid before Parliament. Before the Order is laid before Parliament, the Secretary of State must have consulted relevant interests as to its contents. This will help meet the policy intention that any requirements are reasonable, proportionate and do not place CSPs at a disadvantage compared with their competitors.

  The use of warrants will be subject to specific safeguards and oversight procedures. These include a Commissioner to review the exercise of the Secretary of State's authorisation powers and a Tribunal to deal with complaints. A statutory code of practice is also proposed to govern the conduct of the agencies in applying for and effecting warrants, and in handling the resulting product.

Annex 2

Regulatory Impact Assessment

REGULATION OF INVESTIGATORY POWERS BILL: PART III

1.  TITLE

  Investigation of Electronic Data Protected by Encryption etc.

2.  PURPOSE AND INTENDED EFFECT OF THE MEASURE

(i)   Issue and Objective

  Issue:  The Government is committed to promoting electronic commerce. But for e-commerce to reach its full potential, people need confidence in the security of transactions. Cryptography, the science of how codes work, can help instil that confidence. The technology can be used to guarantee the integrity, authenticity and confidentiality of electronic data. And it can be used to help prevent some types of crime (eg fraud over the Internet). There is a difficulty though in that the same technology can also be put to criminal use.

  For law enforcement, it is the confidentiality aspect that is the important issue—the ability of criminals to protect or "encrypt" the content of their stored data or communications. Strong encryption packages are available whose codes cannot realistically be broken by any means other than using the relevant decryption key. Criminals are increasingly using this technology to frustrate law enforcement investigations. There is currently no explicit legal basis to allow law enforcement agencies to require the disclosure of a decryption key. And the difficulties for law enforcement will increase, as strong encryption becomes more readily available and easier to use.

  Government has a responsibility for ensuring that the United Kingdom remains a secure environment in which e-commerce can flourish. The issue then is how to facilitate the lawful use of cryptography by business and others while making it as difficult as possible for criminals to exploit the same technology for their own purposes.

  Objective:  The proposal is to establish a new statutory power to enable properly authorised persons (such as members of the law enforcement, security and intelligence agencies) to serve written notices requiring the disclosure of the means necessary to make encrypted material intelligible (eg a decryption key) or the disclosure of the material itself in an intelligible form (plain text). They may make this demand of whomever it reasonably appears holds or can access a relevant key. The ability to serve a written notice will only apply to lawfully obtained information and will need to be authorised by, for example, the Secretary of State, Scottish Ministers, or a judge depending on the powers under which information has been, or is being, lawfully obtained. It will be an offence to refuse to comply with the terms of a written notice.

  The objective is to help maintain, so far as possible, the effectiveness of existing statutory powers on which the United Kingdom's law enforcement, security and intelligence agencies rely in combating serious crime and threats to national security.

(ii)   Risk Assessment

  Without the new powers, there is a risk that any criminally minded individual could use encryption successfully to evade detection and prosecution. Criminal use of encryption threatens to undermine statutory law enforcement powers in two broad areas: search and seizure and interception of communications.

  The risk is extremely difficult to quantify but, as an illustration, and at the top end of the scale, the successes outlined in the Regulatory Impact Assessment for Part I of the Bill, achieved as a result of lawful interception of communications, would have been in jeopardy had the criminals encrypted their communications and had the law enforcement agencies lacked the powers to ensure their timely decryption . The prognosis is that law enforcement's difficulties will increase as encryption becomes more pervasive and as communications technologies converge. And the bottom line is that society as a whole will suffer if criminals are able to use new technologies, such as encryption, with complete impunity.

3.  OPTIONS

  Three options have been identified:

  Option 1:  Rely on existing powers.

  Option 2:  Grant further powers to demand access to keys or plain text.

  Option 3:  Establish a system of licensing with mandatory key escrow.

Issues of Equity and Fairness

  None of the identified options would seem likely to discriminate against any particular element of society.

  The most significant equity issue is that which stems from the very use of encryption. The balance to be struck is between ensuring that individuals and businesses may freely use the technology for legitimate purposes whilst limiting the possibilities for using the same electronic processes for criminal purposes. In short, is the potential burden created by the new power to demand access to decryption keys or plain text justified by the need to maintain public safety?

4.  BENEFITS

(i)   Option 1—Rely on existing powers

  The benefits in relying on existing powers would lie in the unfettered way in which the use of encryption could contribute to the development of e-commerce. And whilst recognising that encryption can help prevent certain types of crime, there are no benefits for law enforcement in Option 1 in terms of detecting and prosecuting criminal activity since existing powers are considered to be deficient.

(ii)   Option 2—Grant further powers to demand access to keys or plain text

  It is not considered that this option would significantly fetter the spread of encryption or the development of e-commerce. And it would benefit law enforcement by helping to maintain the effectiveness of existing statutory powers on which the agencies rely in seeking to ensure that the United Kingdom remains a safe place for everyone to live and work (business included).

(iii)   Option 3—Mandatory Key Escrow

  This option would require all providers of encryption services to bank copies of their client's keys with a third party. This would benefit law enforcement since it would facilitate lawful access to keys—usually without the knowledge of the suspect. If key escrow was widely adopted and implemented, no other technique would give anything like the same functionality in meeting the needs of law enforcement. But industry has argued, and the Government has accepted, that mandating the introduction of key escrow would significantly impair the confidence of individuals and business in the confidentiality of their electronic transactions. This lack of confidence would hamper the development of e-commerce—a stated objective of the Government. It would also mean a loss of competitiveness for the United Kingdom economy.

5.  QUANTIFYING AND VALUING THE BENEFITS

  As set out in the Regulatory Impact Assessment for Part I, the objective of combating serious crime is difficult to quantify. The objective of promoting e-commerce presents similar difficulties. The relevant merits of the three options in quantitative terms, then, are not easy to pin down.

  However, the figures for interception successes in Part I give an indication of the potential drawbacks of Option 1. All these successes would be in jeopardy.

  Option 2 would help mitigate these drawbacks to some extent. It seems unlikely that this option, involving properly authorised access to keys/plain text, will significantly limit the development of e-commerce.

  Finally, the merits of making key escrow a mandatory condition of being a licensed provider of cryptographic services (Option 3) were the subject of detailed consideration by a special task force set up under the auspices of the Performance and Innovation Unit (PIU) of the Cabinet Office which held discussions with industry during February and March 1999. A PIU report on encryption and law enforcement, drawing on the findings of the task force, was published in May 1999[93]. It recommended that the Government should no longer pursue key escrow as a policy option.

6.  COMPLIANCE COSTS FOR BUSINESS, CHARITIES AND VOLUNTARY ORGANISATIONS

(i)   Business Sectors Affected

  Encryption software may be supplied and used in a number of ways. For example, the technology might be supplied either directly to an individual customer or indirectly via a company network. It follows that any business involved in producing or supplying encryption products or services or using such products; or individuals using the technology could, conceivably, be affected by the Government's proposals.

  Costs would occur where an individual or a business was the subject of an authorised written notice demanding access to keys or plain text. It is very difficult to predict how frequently this will happen. But the presumption is that in a relatively short space of time, as the technology becomes more widespread and easier to use, encryption will become the technology of choice for criminals seeking to maintain the confidentiality of their communications or data.

(ii)   Compliance Costs

  Option 1 would not result in any additional costs to business since there would be no changes to current practices. Option 3, (key escrow) was proposed by the previous administration in March 1997 as part of a mandatory licensing regime and previously considered as an element of this Government's approach (but under a voluntary licensing scheme). Key escrow would involve costs associated with the secure storage of keys but this was not the only factor in the decision to abandon this option. Business argued that to impose key escrow on them would hinder their business development without significantly helping the law enforcement case. Both technical and commercial reasons were identified which ultimately led to the abandonment of the policy linking key escrow to licensing.

  Under Option 2, law enforcement agencies would have the power to serve written notices requiring that a relevant decryption key is surrendered or that specified material is delivered up in an intelligible form (plain text). The individual or organisation served with the notice would therefore incur certain costs in the process of complying with the terms of the notice. Keys or plain text would be required to be delivered in a timely and secure fashion. Compliance costs may vary on a case to case basis and may differ depending on the technology being used. Providing actual figures on compliance costs is difficult at this stage. The market is in its infancy and it is impossible to predict the range and type of services which will emerge.

  The Government envisages that in most cases, the production of plain text will be deemed acceptable in response to the service of a notice, especially with respect to reputable businesses. Compliance costs may, in such instances, be limited to the administrative costs of processing that notice and handing over the plain text of the data in question. These costs could range from a few hundred to a few thousand pounds depending on the nature of the organisation and the data in question. Costs may be greater where, in cases of urgency for example, an organisation is required to provide assistance outside the times it normally operates or where information has to be sourced from another site (possibly outside the United Kingdom). But in any case, the Government is proposing to meet the marginal costs which eg a business might incur in complying with the requirements of a notice (along the lines of the present regime for interception warrants).

  Where a notice specifies that a key be handed over, the individual/business will need to take a view on whether their security has been compromised and there is a need to change their or their clients keys. The Bill contains Statutory safeguards governing the retention and use to which a key obtained under the new powers may be put. But despite this, a business may decide that its security has been compromised and may incur consequential costs in changing keys. These will depend on the size and nature of the security system concerned. They could be limited to fairly modest IT and administration costs running from a few hundred to perhaps a few thousand pounds, depending on the individual circumstances. The Government envisages that this outcome is only likely to occur in a minority of cases.

(iii)   Total Compliance Costs

  Estimating total compliance costs is difficult because of the variables involved in the calculation. It is difficult to predict precisely how often the new law enforcement powers would be used. But experience indicates that criminals are quick to exploit new technologies in an attempt to evade detection. So the presumption is that an increasing proportion of unintelligible material will be encountered during law enforcement investigations (such as those involving interception, numbers for which are outlined in Part I) as strong encryption technologies become more readily available and easier to use. Individual costs for complying with notices are also difficult to predict (as indicated in (ii) above) as are consequential costs incurred in changing keys. A rough estimate could be achieved though by taking an average consequential cost of say, £2,000 for changing a key. Even if this was multiplied by, say, an illustrative figure for interception warrants issued per year (2,031 for 1998), total compliance costs to business relating to Part III of the RIP Bill are not expected to exceed the measure of significance (£20 million) used by the Regulatory Impact Unit of the Cabinet Office.

7.  RESULTS OF CONSULTATIONS

  The Government published a consultation document on 5 March 1999[94] proposing that new powers to require disclosure of decryption keys or plain text be introduced (ie Option 2). The DTI published a summary of responses in July 1999[95]. Of those responding, there was a general recognition that law enforcement agencies should be given reasonable assistance (subject to proper authorisation) to carry out investigations. Law enforcement agencies responding to the document were unanimous that the actual or potential threat use of encryption by criminals represents a serious threat to them and to society. There was a welcome that new powers were being proposed to counter this threat.

  The PIU report on encryption and law enforcement, published in May 1999, which drew on the work of the special task force on encryption which held detailed discussions with industry about the encryption issue, discounted linking key escrow to licensing (Option 3) as a way forward. But the report specifically recommended the introduction of new powers to assist law enforcement agencies (ie Option 2).

  A draft Electronic Communications Bill was published on 23 July 1999[96] for public consultation. It contained draft Clauses providing for new powers to allow lawful access to decryption keys or the plain text of encrypted material under proper authority (ie Option 2). A summary of responses was again published by the DTI in November 1999[97]. The Government has considered carefully the views of commentators who expressed a number of concerns about the detailed legislative proposals. And having reflected carefully on its position, the Government decided that the proposed new law enforcement powers should be removed from the DTI's Electronic Communications Bill (which was subsequently introduced to Parliament on 18 November 1999) and included in the Regulation of Investigatory Powers (RIP) Bill. The provisions which appear in the Bill include a number of changes made in the light of the consultation exercise.

8.  SUMMARY AND RECOMMENDATIONS

  Following Option 1 is not realistic. It is essential that statutory powers designed to protect public safety are not undermined by new technologies. Encryption is already causing difficulties for law enforcement agencies and these will undoubtedly increase. As regards Option 3, the Government's consultation document published in March consulted on the basis that key escrow would not be a requirement of licensing. The Government accepted the recommendation contained in the PIU report to abandon the policy of linking key escrow to licensing. It has explicitly been ruled out as an option in the DTI's Electronic Communications Bill currently before Parliament (Clause 13).

  Option 2, providing new powers to allow access to decryption keys or plain text under proper authority, has therefore been identified as the most appropriate way forward which goes some way to meeting the needs of law enforcement while, at the same time, not hindering the growth of e-commerce in the UK. This will entail some costs to those served with written notices. But these must be set against the wider costs to society (eg those involved in tackling the drugs problem set out in the Regulatory Impact Assessment for Part I) that would result from criminals being able to use encryption technologies with impunity. It is considered that the balance therefore lies in favour of pursuing Option 2. And there are benefits which, in monetary terms, are not easily defined. Take Internet paedophile activity as an example. Each paedophilic image is an instance of child abuse. Given the propensity for those involved in distributing such images over the Internet to use encryption to conceal their activities, victims of abuse will remain unidentified and their abusers free to commit further crimes unless law enforcement has the ability to decrypt such material.

9.  ENFORCEMENT, SANCTIONS, MONITORING AND REVIEW

  It will be necessary to obtain proper authority to invoke the new powers requiring the disclosure of decryption keys or plain text. The level of authority will vary depending on the underlying statutory power. In many cases, this will mean that use of the power will need to be authorised by, for example, the Secretary of State, Scottish Ministers or a Judge.

  It is proposed to introduce two new offences in relation to the new powers: an offence of failure to comply with the terms of a written notice and, in certain circumstances, an offence of "tipping off" another person that a notice has been served or the content of it. There will be statutory defences.

  The use of these powers will be subject to specific safeguards and oversight procedures to protect the security and privacy of material obtained under a written notice. There will be a Commissioner to review the exercise of the Secretary of State's new authorisation powers and a Tribunal to deal with complaints. It is also proposed that the Secretary of State consults on, and issues, a Statutory Code of Practice governing the use of the new powers.





Annex 3

Draft order laid before Parliament under section 12(10) of the Regulation of Investigatory Powers Act 2000 for approval by resolution of each House of Parliament

DRAFT STATUTORY INSTRUMENTS

2002 No.

Investigatory Powers

  The Regulation of Investigatory Powers (Maintenance of Interception Capability) Order 2002

    Made ..................................................................2002

    Coming into force .............................1st August 2002

  Whereas the Secretary of State has consulted the persons listed in section 12(9) and (11) of the Regulation of Investigatory Powers Act 2000 ([98]) about this order;

  And whereas a draft of this Order has been laid before Parliament and approved by a resolution of each House;

  Now, therefore, the Secretary of State, in exercise of the powers conferred on him by section 12(1), (2) and (5) and section 78(5) of that Act, hereby makes the following Order:

Citation, commencement and interpretation

  1.—(1) This Order may be cited as the Regulation of Investigatory Powers (Maintenance of Interception Capability) Order 2002 and shall come into force on 1st August 2002.

  (2)  In this order "service provider" means a person providing a public postal service or a public telecommunications service, or proposing to do so.

Interception capability

  2.—(1)  The Schedule to this Order sets out those obligations which appear to the Secretary of State reasonable to impose on service providers for the purpose of securing that it is and remains practicable for requirements to provide assistance in relation to interception warrants to be imposed and complied with.

  (2)  Subject to paragraph (3) the obligations in—

    (a) Part I of the Schedule only apply to service providers who provide, or propose to provide, a public postal service; and

    (b) Part II of the Schedule only apply to service providers who provide, or propose to provide, a public telecommunications service.

  (3)  The obligations in Part II of the Schedule shall not apply to service providers who—

    (a) do not intend to provide a public telecommunications service to more than 10,000 persons in any one or more parts of the United Kingdom and do not do so; or

    (b) only provide, or propose to provide, a public telecommunications service in relation to the provision of banking, insurance, investment or other financial services.

INTERCEPTION CAPABILITY NOTICES

  3.—(1)  The Secretary of State may give a service provider a notice requiring him to take all such steps falling within paragraph (2) as may be specified or described in the notice.

  (2)  Those steps are ones appearing to the Secretary of State to be necessary for securing that the service provider has the practical capability of meeting the obligations set out in the Schedule to this Order.

REFERRAL OF NOTICES TO THE TECHNICAL ADVISORY BOARD

  4.  The period within which any person to whom a notice has been given under article 3 may refer the notice to the Technical Advisory Board is specified as being before the end of 28 days from the date of the notice.

  Home Office Parliamentary Under-Secretary of State 2002

SCHEDULE    Article 2

OBLIGATIONS ON SERVICE PROVIDERS

Part I:

  1.  To ensure the interception and temporary retention of postal items destined for addresses in the United Kingdom for provision to the person on whose application the interception warrant was issued.

  2.  To provide for the interception and retention of postal items sent by identified persons where the carrier keeps records of who sent which item in the course of their normal business.

  3.  To maintain a system of opening, copying and resealing of any postal item carried for less than £1.

  4.  To comply with the obligations set out in paragraphs 1 to 3 above in such a manner that the chance of the interception subject or other unauthorised persons becoming aware of any interception is minimised.

Part II: Interception Capability for Public Telecommunication Services

  5.  To provide a mechanism for implementing interceptions within one working day of the service provider being informed that the interception has been appropriately authorised.

  6.  To ensure the interception, in their entirety, of all communications and related communications data authorised by the interception warrant and to ensure their simultaneous (ie in near real time) transmission to a hand-over point within the service provider's network as agreed with the person on whose application the interception warrant was issued.

  7.  To ensure that the intercepted communication and the related communications data will be transmitted so that they can be unambiguously correlated.

  8.  To ensure that the hand-over interface complies with any requirements communicated by the Secretary of State to the service provider, which, where practicable and appropriate, will be in line with agreed industry standards (such as those of the European Telecommunications Standards Institute).

  9.  To ensure filtering to provide only the traffic data associated with the warranted telecommunications identifier, where reasonable.

  10.  To ensure that the person on whose application the interception warrant was issued is able to remove any electronic protection applied by the service provider to the intercepted communication and the related communications data.

  11.  To enable the simultaneous interception of the communications of up to 1 in 10,000 of the persons to whom the service provider provides the public telecommunications service, provided that those persons number more than 10,000.

  12.  To ensure that the reliability of the interception capability is at least equal to the reliability of the public telecommunications service carrying the communication which is being intercepted.

  13.  To ensure that the intercept capability may be audited so that it is possible to confirm that the intercepted communications and related communications data are from, or intended for the interception subject, or originate from or are intended for transmission to, the premises named in the interception warrant.

  14.  To comply with the obligations set out in paragraphs 5 to 13 above in such a manner that the chance of the interception subject or other unauthorised persons becoming aware of any interception is minimised.

EXPLANATORY NOTE

(This Note is not part of the Order)

  Part I of the Regulation of Investigatory Powers Act 2000 ("the 2000 Act") contains provisions about the interception of communications transmitted by means of public postal service or a public telecommunications service. Interception is permitted under the 2000 Act by certain public authorities who obtain an interception warrant. This Order sets out the obligations which it appears to the Secretary of State reasonable to impose on the providers of public postal services or a public telecommunications services ("service providers") for the purpose of securing that it is and remains practicable for requirements to provide assistance in relation to interception warrants to be imposed and complied with.

  These obligations are set out in the Schedule to the Order. The obligations in Part I of the Schedule relate only to persons who provide, or propose to provide, a public postal service. The obligations in Part II of the Schedule relate only to persons who offer, provide, or propose to provide a public telecommunications service to more than 10,000 persons in any one or more parts of the United Kingdom, other than service providers who only provide a public telecommunications service in relation to the provision of banking, insurance, investment or other financial services.

  Article 3 enables the Secretary of State to ensure compliance with the obligations by providing that he may give a service provider a notice requiring it to take the steps described in the notice. The notice may only contain steps which appear to the Secretary of State necessary for securing that that service provider has the practical capability of meeting those obligations set out in the Schedule which apply to that service provider.

  Article 4 specifies the period within which a person served with a notice may refer it to the Technical Advisory Board.

  This Order was notified in draft to the European Commission in accordance with Directive 98/34/EC, as amended by Directive 98/48/EC.


89   PSA: "Action against Illegal Drugs". Back

90   Research by South Bank University. Back

91   Memorandum from HM Customs and Excise to the Treasury Select Committee Sub-Committee. Back

92   It should be noted that a proportion of the increase in warranty activity is partly due to the larger number of services being used by individual interception subjects, rather than being entirely due to an increase in the number of interception targets per se. Back

93   Encryption and Law Enforcement-A Performance and Innovation Unit Report-26 May 1999. Back

94   Building Confidence in Electronic Commerce-URN 99/642. Back

95   URN 99/891. Back

96   Promoting Electronic Commerce-Cm 4417. Back

97   URN 99/1218. Back

98   2000 c. 23. Back


 
previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries index

© Parliamentary copyright 2002
Prepared 5 August 2002