Unit 7: The Law and what you should know
Regulation of Investigatory Powers Act 2000
What is the Act about? What are the ‘Investigatory Powers’ it regulates?
The Regulation of Investigatory Powers Act 2000, or ‘RIPA’ as it is commonly known, governs the use of covert surveillance by public bodies. This includes bugs, video surveillance and interceptions of private communications (eg phone calls and emails), and even undercover agents (‘covert human intelligence sources’).
It’s important to note that RIPA does not just cover surveillance by police but also by other law enforcement bodies (eg the Serious Fraud Office or the Serious Organised Crime Agency), the security and intelligence services (MI5, MI6 and GCHQ), as well as a large number of other public bodies, including local government.
So this is why local authorities have been able to use surveillance powers in relation to school boundaries, disabled parking and alleged anti-social behaviour?
Yes, the Act provides a detailed framework for surveillance activities, although not everything understood as surveillance would be covered by RIPA. As a general rule, RIPA governs active surveillance – actions interfering with individual privacy that would normally be illegal if carried out by a private individual, eg installing a listening device in someone’s house, but can be lawful because carried out for a legitimate governmental purpose, eg detecting crime. It does not extend to other privacy technologies such as databases or CCTV (except, for example, where the CCTV camera was installed in such a way as to monitor a private home).
How does the Act work?
The Act distinguishes between interception of private communications and communications data (Part 1), directed surveillance and instrusive surveillance (Part 2).
What’s the difference between intercept and communications data?
Interception of private communication (phone calls, emails, text messages, faxes, etc) or ‘intercepts’ are the most sensitive kind of surveillance. With few exceptions, interceptions are authorised under warrant by the Home Secretary and anything obtained pursuant to a warrant – and the warrant itself – is completely inadmissible in any legal proceedings. This is because of the fears of MI5 and MI6 that using intercept evidence would reveal too much about their interception capabilities.
‘Communications data’ is different from intercept in that it is information about a communication rather than its contents. For example, the record of your phone provider that you called a particular telephone number on a particular time and date is communications data. What was actually said as part of telephone call would normally be covered by an intercept.
Okay, what’s the difference between directed and intrusive surveillance?
‘Directed’ surveillance is surveillance that is conducted as part of a specific investigation and carried out ‘in such a manner as is likely to result in the obtaining of private information about a person’.
‘Intrusive’ surveillance is directed surveillance that involves either residential premises, a private vehicle, or any kind of surveillance device. So, for example, following a suspect down a street as part of an operation would be directed surveillance. Planting a bug in someone’s house, by contrast, would be intrusive surveillance.
What kind of oversight is there for this?
Part 4 of the Act does provides for three commissioners: the Interception of Communications Commissioner, the Intelligence Services Commissioner and the Chief Surveillance Commissioners. There is also an Investigatory Powers Tribunal established to hear complaints related to surveillance.
Unfortunately, the Act is extremely complex and the kind of authorisation required and level of oversight available depends very much on the kind of surveillance: intercept, communications data, directed surveillance and instrusive surveillance. Generally speaking, the least instrusive kinds of surveillance are largely self-authorised by a senior member of the public body concerned, with after-the-fact scrutiny by the relevant commissioner. More instrusive surveillance requires the involvement of the Surveillance Commissioner but there is no prior judicial authorisation required for intercepts – the most intrusive kind of surveillance. Accordingly, the UK is judged to have one of the weakest systems of surveillance regulation of any EU or common law country.
Prior judicial authorisation? Why is that important?
In virtually every other common law country, eg United States, Canada, South Africa, etc – interceptions and bugs by law enforcement require a judicial warrant. This means that the police have to apply ex parte to a judge for permission before they can carry out surveillance. By contrast, an interception warrant under Part 1 of RIPA is granted by the Home Secretary.
The European Court of Human Rights has held that the right to respect for private life requires the law governing lawful covert surveillance to ‘provide some protection to the individual against arbitrary interference with Article 8 rights’.1 However, the fact that surveillance powers are now being employed in disputes about school boundaries suggests otherwise.
Coherent reform of surveillance powers in the UK would begin by requiring all kinds of surveillance to be authorised by an independent judicial authority, rather than elected (or in some cases even unelected) public officials.
Computer Misuse Act 1990
It is important to remember that the methods taught in this course are to be used for educational purposes or for use on your own devices,when using computer monitoring software and hardware you must be aware of the Computers misuse act 1990 sections 1 and 3 mainly:
Unauthorised access to computer material.
Section 1
(1)A person is guilty of an offence if
(a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer
(b)the access he intends to secure [or to enable to be secured,] is unauthorised; and
(c)he knows at the time when he causes the computer to perform the function that that is the case.
(2)The intent a person has to have to commit an offence under this section need not be directed at—
(a)any particular program or data;
(b)a program or data of any particular kind; or
(c)a program or data held in any particular computer.
(3)A person guilty of an offence under this section shall be liable
(a)on summary conviction in England and Wales, to imprisonment for a term not exceeding 12 months or to a fine not exceeding the statutory maximum or to both;
(b)on summary conviction in Scotland, to imprisonment for a term not exceeding six months or to a fine not exceeding the statutory maximum or to both;
(c)on conviction on indictment, to imprisonment for a term not exceeding two years or to a fine or to both
Section 3
Unauthorised acts with intent to impair, or with recklessness as to impairing, operation of computer, etc.
(1)A person is guilty of an offence if—
(a)he does any unauthorised act in relation to a computer;
(b)at the time when he does the act he knows that it is unauthorised; and
(c)either subsection (2) or subsection (3) below applies.
(2)This subsection applies if the person intends by doing the act—
(a)to impair the operation of any computer;
(b)to prevent or hinder access to any program or data held in any computer;
(c)to impair the operation of any such program or the reliability of any such data; or
(d)to enable any of the things mentioned in paragraphs (a) to (c) above to be done.
(3)This subsection applies if the person is reckless as to whether the act will do any of the things mentioned in paragraphs (a) to (d) of subsection (2) above.
(4)The intention referred to in subsection (2) above, or the recklessness referred to in subsection (3) above, need not relate to—
(a)any particular computer;
(b)any particular program or data; or
(c)a program or data of any particular kind.
(5)In this section—
(a)a reference to doing an act includes a reference to causing an act to be done;
(b)“act” includes a series of acts;
(c)a reference to impairing, preventing or hindering something includes a reference to doing so temporarily.
(6)A person guilty of an offence under this section shall be liable—
(a)on summary conviction in England and Wales, to imprisonment for a term not exceeding 12 months or to a fine not exceeding the statutory maximum or to both;
(b)on summary conviction in Scotland, to imprisonment for a term not exceeding six months or to a fine not exceeding the statutory maximum or to both;
(c)on conviction on indictment, to imprisonment for a term not exceeding ten years or to a fine or to both.