Officers from the National Crime Agency (NCA) arrested Lauri Love during a search of his parent’s home on 25 October 2013. The alleged offences were under s 1(1) and (3) of the Computer Misuse Act 1990 (CMA 1990). He was released on police bail but in or around July 2014 he was shown a letter by his MP from the Crown Prosecution Service stating that no further action was being taken against him.
In February 2014 the NCA served a notice under s 49 of the Regulation of Investigatory Powers Act 2000 (RIPA 2000). In summary such a notice required disclosure by Mr Love to the NCA of the passwords relating to the devices they had seized. Evidently Mr Love failed to comply with the notice. However the NCA did not pursue the matter further.
The application
Mr Love brought an application under s 1 of the Police Property Act 1897 for the return of computer and storage devices seized during the search. During the course of these proceedings, the NCA sought an order for disclosure of the passwords. This request quite properly concerned a number of high profile commentators, including David Allen Green and Ryan Gallagher.
In the event, the District Judge ruled that to order disclosure would circumvent the provisions of RIPA 2000. However the case gives to other issues that this blog explores (note, I am not being declarative about the points made).
The NCA was created by s 1 of the Crime and Courts Act 2013 to investigate serious and organised crime. Offences under the MCA 1990 certainly have the potential to fall within what most would consider serious and organised crime. The NCA’s permitted purposes are broad and include the investigation of any crime (whether serious and organised or not) but clearly questions could properly be asked about the allocation of resources if it was routinely investigating offences that were less than serious and organised. By the time the Police Property Act application was considered it appears the investigation into Mr Love had changed somewhat, the NCA identifying only that it suspected he had names and passwords of users of the online magazine Police Oracle and films allegedly copied in breach of copyright. These are significantly less serious than offences under MCA 1990 and are often dealt with as civil, not criminal, matters.
Section 49 RIPA 2000
Under s 49 RIPA 2000, the NCA would ordinarily need to get appropriate permission from a circuit judge unless it was covered by one of the exemptions (it is not clear whether an exemption applied in Mr Love’s case – but the s 49 notice followed the arrest by 5 months – so this seems unlikely). It is important to remember that a judge is not ordering disclosure of the passwords but rather giving permission for the service of the notice. If the recipient of the notice fails to comply he or she can be charged with an offence under s 53 of RIPA 2000, which carries up to five years imprisonment on conviction on indictment.
Two serious issues arise then from the attempt by NCA to secure the passwords in the course of the Police Property Act proceedings. The first is that they were seeking an order that went beyond the powers of a judge under RIPA 2000: s 49 would not require disclosure of the passwords, merely subject the recipient to the risk of a custodial sentence if found guilty of failing to comply. The second is that they were asking for the order from a District Judge not a Circuit Judge and is not clear the criteria was met for them to do so.
There are no particular rules as to the form of an application for appropriate permission to serve a s 49 Notice under RIPA. It is a question of substance and the NCA’s application appears to have at least included, for all intents and purposes, an application for appropriate permission under s 49. Since they already had secured a notice but had chosen not to bring proceedings alleging an offence had been committed the application was on the face of it duplicitous (in the legal sense) and abusive.
The Code of Practice
The Code of Practice on Investigation of Protected Electronic Information (encryption) requires at paragraphs 3.36-4.42 that the NCA must be satisfied it is necessary to seek a notice and has to consider, by way of one example, “the benefit to the investigation…” (the link to the Code is at the time of writing unavailable). It is not clear there remained an “investigation” (since it has been referred to the CPS and a decision has been taken not to charge) so it is questionable that NCA could be so satisfied. It could be argued the file remains open but insofar as offences are capable of now being identified, these appear to relate to copyright infringement. Moreover there is no evidence that the test of necessity and proportionality were considered. The NCA have previously fallen foul of the application of this test in the recent case of Chatwani (discussed here).
Section 65, RIPA 2000
There is another important point that arises and it is the question of the jurisdiction of the criminal courts to hear the application. This is governed by s 65 RIPA 2000. Mr Love was running a HRA 1998 argument (that any order would breach s 6 of 1998 Act as it would be a violation of Article 8 of the European Convention on Human Rights). Under s 65(2)(a) the Investigatory Powers Tribunal is the “only appropriate tribunal for the purposes of s 7, HRA” (incompatibility: see for an example of the operation of these provisions the Supreme Court case of A v B). The proceedings have to fall within s 65(3). These include “proceedings relating to the taking place in challengeable circumstances of any conduct falling within subsection (5)”. Subsection (5) includes at (e) “the giving of a notice under s 49…”. It is not clear but the jurisdiction of the Magistrates’ Court may have been ousted as a result.
© Simon McKay (2016). Please ask for my permission before using or copying the material contained in this blog. If you do use it, attribute it to me with a link to the original content where possible. This is opinion, not legal advice.