Source:
http://www.idg.net/crd_idgsearch_0.html?url=http%3A%2F%2Fwww%2Enwfusion%2Ecom%2Fnews%2F2000%2F0727snooping%2Ehtmlsc=47345469_114894
U.K. e-mail snooping bill passed into law
By LAURA ROHDE
IDG News Service, 07/27/00
LONDON -- The surveillance bill granting the U.K. government sweeping
powers to access e-mail and other encrypted Internet communications
passed its final vote in the House of Commons on Wednesday and is set to
become law on Oct. 5.
Among other provisions, the Regulation of Investigatory Powers (RIP)
bill requires ISPs in the U.K. to track all data traffic passing through
their computers and route it to the Government Technical Assistance
Center (GTAC). The GTAC is being established in the London headquarters
of the U.K. security service MI5 -- the equivalent of the United States'
FBI.
The House of Commons, which already passed the RIP bill earlier this
year, voted to approve amendments added by the House of Lords on July
13. Mainly as a formality, the bill must now be signed by the Queen to
receive its official passage into law with what is known as the Royal
Assent.
Some U.K. ISPs and civil rights organizations have argued that the
amendments are mainly cosmetic and do not adequately address the "Big
Brother" powers granted to the government to access e-mail and other
electronic data without a warrant.
Under the provisions of the RIP bill, the U.K. government --
specifically the Home Office and its head, the Home Secretary (a post
currently held by Jack Straw) -- can demand encryption keys to any and
all data communications, with a prison sentence of two years for those
who do not comply with the order.
Furthermore, if a company official is asked to surrender an encryption
key to the government, that individual is barred by law from telling
anyone -- including his employer, be it senior management or security
staff -- that he has done so. Guidelines for this "tipping-off"
offense, as it is known, could leave an international company completely
unaware that what it assumes is secure company data may be under
investigation by MI5. Those violating the tipping-off offense can face
up to five years in prison.
While U.K. employees are protected against the consequences of passing
encryption keys or encrypted data to the government, that protection
does not extend outside the U.K. to other jurisdictions, such as that of
a parent company.
Civil liberties organizations are worried that the government's e-mail
interception bill will grossly encroach on privacy, while businesses
fear the law will force e-commerce companies to move operations to other
countries, such as Ireland, which do not have such restrictions. And
ISPs in the U.K. are concerned that the cost of establishing the
technology required by the RIP bill would be crippling. Some ISPs,
including PSINet, have said they will be forced by the RIP bill to move
their operations out of the U.K. altogether.
On June 16, the House of Lords received an open letter signed by 50
organizations, asking that the bill be further amended or just plain
scrapped. The letter, which in part reads: "We are deeply concerned
that the bill will inhibit the development of the Internet and
e-commerce," includes Esther Dyson, Consumers International and Amnesty
International as signers.
The amendments added by the House of Lords -- while not changing any of
the major provisions in the RIP law -- give the government the
discretion to allow companies to turn over printed text rather than
encryption keys. Furthermore, as with telephone wire taps, the Home
Secretary must now personally approve in writing all interception
warrants as well as financial compensation for ISPs required to install
monitoring equipment.
During Wednesday's debate in the House of Commons, Home Office Minister
Charles Clarke argued that the RIP bill will not harm e-commerce in the
U.K., and that the law suffers primarily from a perception problem,
caused mainly by alarmist reports in the media.
"Given the comments made in the overseas media, we must explain clearly
what the bill is and is not, and why we do not believe it poses a threat
to e-commerce in Britain; on the contrary, it will help to achieve the
government's aim of a strong and secure e-commerce economy, to which we
are all committed," Clarke said to the House of Commons.
Clarke emphasized that "propaganda is needed" to re-educate the public
about the provisions of the bill and asked the House with help in
promoting "the interests of this country's businesses when the time
comes."
The BBC has estimated that implementing the RIP bill will cost companies
$69.9 billion over five years, a claim that Jack Straw vehemently denied
in a letter sent to the Financial Times on June 14 and posted on the
Home Office Web site.
Some opponents of the RIP bill are pointing out that the technology
provided for in the bill is already out of date and fairly simple to
circumvent.
In an article for New Scientist magazine,
