The Silicon.com Survey: RIP and you

The Home Office's Regulation of Investigatory Powers (RIP) Bill has evaded prolonged protest among the mainstream IT community. Designed to regulate police surveillance in the fight against crime, until now, the so-called 'Snooping Bill' has only had civil rights groups up in arms over its implications for human rights.

Despite a second reading in Parliament and a standing committee session which ended on Friday, 60 per cent of readers responding to a Silicon.com survey conducted last week, said they'd only become aware of the RIP Bill within the last three months - this is a community that should be in the know.

Now they do know, they're extremely concerned. The survey generated a consensus reflecting a belief that RIP is useless as a deterrent to criminals, is isolated from existing legal principles, and will harm those people it is meant to protect.

RIP is designed as a framework for law enforcement agencies using surveillance tactics in criminal investigations and contains updated legislation covering electronic communications. The bone of contention is the section covering an issue new to this area: encryption.

If coded data is required in an investigation, under current legislation, police will win the power to charge individuals if they cannot produce an encryption key or prove they never had the key in the first place. The main sticking point is that the 'burden of proof' is reversed. In other words, individuals are faced with the impossible task of proving a negative.

Silicon.com asked its viewers if RIP is necessary to protect the individual from criminal activity. Nearly three-quarters (73.6 per cent) of respondents said no.

A common criticism was that it the legislation will fail to deter criminals. One viewer said: "Firstly, I have not seen any evidence that encryption is actually a problem in criminal investigation. Secondly, no one will give up their key to reveal evidence of a serious crime. Imagine what they'll think: 'Hmmm, either I can go to jail for two years for not handing over my key, or I can let them see my plan for blowing up the Houses of Parliament with cocaine-laced child-pornography - tough choice.'"

This argument has been rejected in a statement issued by the Home Office. Responding directly to criticisms forwarded by Silicon.com on behalf of its readership, the statement read: "Encryption is already hampering law enforcement investigations." But Home Office literature covering the use of encryption in crime includes examples rather than statistics. The above reader might conclude these are exceptions that prove the rule.

While acknowledging the need to control crime on the Net, the majority of respondents echoed the arguments of civil rights groups that reversing the burden of proof is tantamount to transforming the UK into a police state.

Another viewer said: "The onus is on the suspect to prove that he or it does not possess certain information. Ever tried to prove a negative? It is almost impossible. I regard the Bill as extremely dangerous and a blatant infringement of basic human rights."

Respondents from the business community were concerned about the effect of police monitoring on UK business and ecommerce. One respondent said: "RIP would mean that I may have to be careful not to put any client details on my system - especially if my contract with them requires that business details be kept confidential."

For others it is far more serious. "We will probably have to close down. We currently run a confidential information centre for battered and abused women. This legislation will effectively outlaw most of our organisation's operations. Personally, the bill will make me think twice before using the Net for casual communications due to the increased risk of my mail being intercepted and misinterpreted."

The Home Office statement claimed: "This is certainly not the Government's intention," and argued that interception will be authorised only in the interests of national security. But this assertion may not be enough to reassure this particular respondent or those that depend on his service.

Some even claimed they will be forced to emigrate if the Bill comes into effect.

The consequences are not limited to homegrown UK businesses. It seems foreign investors and companies considering the UK as a location for business may reconsider if the law is implemented.

One viewer recounted a worrying anecdote concerning a lawyer friend who had been explaining the ins and outs of RIP to the global security manager of a large multinational. The result was an urgent memo from the manager to his CEO recommending the suspension of all UK investment strategies.

Also raised were concerns about law agencies' abilities to keep encryption keys safe when they have been apprehended in a case. Given the MI5's recent embarrassment over two misplaced notebook PCs harbouring top secret material, they may have a point.

The Home Office has consistently dismissed the concerns of civil rights movements as hysteria. In an open letter, Home Office minister Charles Clarke said: "The burden - and it is a significant one - falls on the prosecution to prove, beyond reasonable doubt, that an accused person is, or has been, in possession of a key."

Establishing whether a person should be prosecuted if they can't prove a key has been lost will depend on 'the balance of probabilities' according to Clarke. Nevertheless, the burden remains on the defendant to prove he/she has innocently lost a key or forgotten a password.

These reassurances are not enough for Silicon.com's readers, who claim the message is clear: RIP is a snooping, unworkable, illogical piece of legislation that represents the government's attempt to claw the back the control it fears it has lost through the rise of the Net.