West Law Report

Knowledge of key distinct from encrypted data

Posted in Times Law Report by mrkooenglish on October 23, 2008

From The Times
October 15, 2008
Knowledge of key distinct from encrypted data
Court of Appeal, Criminal Division
Published October 15, 2008
Regina v S(F) and A(S)
Before Lord Judge, Lord Chief Justice, Mr Justice Penry-Davey and Mr Justice Simon
Judgment October 9, 2008

The key or password which provided access to an encrypted computer file was a fact. It did not constitute an admission of guilt. But knowledge of the key might be incriminating if the data contained incriminating material.

The Court of Appeal, Criminal Division, so held when giving reasons for dismissing, on July 29, 2008, an interlocutory appeal under section 35 (1) of the Criminal Procedure and Investigations Act 1996 by S(F) and A(S) against the decision of Judge Stephens, QC, at the Central Criminal Court during the course of a preparatory hearing, on June 26, 2008, when he refused to order that counts alleging that the appellants had committed offences under section 53 of the Regulation of Investigatory Powers Act 2000 be stayed.

Mr Matthew Ryder and Mr Steven Powles for S; Mr Nick Wrack for A; Mr Nigel Goldsmark QC and Mr Louis Mably for the Crown.

THE LORD CHIEF JUSTICE said S and A were alleged to have conspired together, and with H and others, in breach a control order to which H was subject, to assist H to abscond from his address in Leicester and convey him to a new, secret address in Sheffield.

Shortly after their arrival in Sheffield, the police entered the premises. S was found alone in the same room as a laptop computer. The key to an encrypted file appeared to have been partially entered.

S was arrested, his home address in London was searched and computer material revealed. Various documents had been deleted from the computer hard drives, but when retrieved they provided the basis for charges against S under section 58 of the Terrorism Act 2000, namely, possessing documents or records of information of a kind likely to be useful to a terrorist or potential terrorist.

However, without the encryption keys for the encrypted files present on the computer hard drives, the encrypted files could not be accessed and their contents examined.

A was also arrested on the same day. One of his computer disks also had an encrypted area.

S and A were charged with conspiracy to breach the control order imposed on H and were served, pursuant to section 53 of Regulation of Investigatory Powers Act 2000 with notices which imposed a legal obligation to disclose full encryption keys to allow access to the encrypted material.

Their refusal to comply with those notices formed the basis of the counts in the indictment which the judge was invited to stay on the ground that the requirement to provide that information to the police constituted an impermissible infringement of the privilege against self-incrimination and contravened article 6 of the European Convention on Human Rights, guaranteering the right to a fair trial. The judge rejected the application. S and A appealed.

Their Lordships were invited to proceed on the basis that, although no admissions were made, if the appropriate key were provided, incriminating material might be discovered.

On analysis, the key which provided access to protected data, like the data itself, existed separately from each defendant’s will. If investigating officers were able to identify the key from a different source, say, for example, from the records of the shop where the equipment was purchased, no one would argue that the key was not distinct from the equipment which was to be accessed.

In that sense the key to the computer equipment was no different from the key to a locked drawer. The contents of the drawer existed independently of the suspect; so did the key to it. The contents might or might not be incriminating; the key was neutral.

However, the defendants’ knowledge of the keys might become an incriminating fact, that was, it might support the prosecution case that the defendants were knowingly in possession of the encrypted material.

In their Lordships’ judgment, the correct analysis was that the privilege against self-incrimination might be engaged by a requirement of disclosure of knowledge of the means of access to protected data under compulsion of law.

If Judge Stephens’ ruling treated that knowledge as identical to the key to it, their Lordships respectfully disagreed. In short, although the defendants’ knowledge of the means of access to the data might engage the privilege against self-incrimination, it would do so only if the data itself, which undoubtedly existed independently of the will of the defendants and to which the privilege against self-incrimination did not apply, contained incriminating matters. Accordingly, the extent to which the privilege against self-incrimina-tion might be engaged was indeed very limited.

The purpose of the statute was to regulate the use of encrypted material and, in relation to any subsequent trial, the powers under section 78 of the Police and Criminal Evidence Act 1984 to exclude evidence in relation (i) to the underlying material, (ii) the key or means of access to it, and (iii) an individual defendant’s knowledge of the key or means of access, remained.

Neither the process, nor any subsequent trial could realistically be stigmatised as unfair. In those circumstances, there was no basis for interfering with Judge Stephens’ indication of how he would have exercised his discretion if, contrary to his view, an issue of self-incrimination arose.

Solicitors: Birnberg Peirce & Partners; Birnberg Peirce & Partners; Crown Prosecution Service, Headquarters.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: