S & Anor, R v

On 29 July 2008 we dismissed an interlocutory appeal under section 35(1) of the Criminal Procedure Investigations Act 1996 by S and A against the decision of His Honour Judge Martin Stephens QC at the Central Criminal Court, during the course of a Preparatory Hearing heard on 26^th June 2008, when he refused to order that counts alleging that the appellants had committed offences under section 53 of the Regulation of Investigatory Powers Act 2000 (RIPA) should be stayed. These are the reasons for our decision.

During 2007 H was made the subject of a control order under the Prevention of Terrorism Act 2005. The order obliged him to live and remain in Leicestershire, and not to leave his home address without the consent of the Secretary of State for the Home Department. The present appellants are alleged to have conspired together, and with H and others, to breach that order. The objective of the conspiracy was to assist H to abscond from his address in Leicester and to convey him to a new, secret address in Sheffield. On 9 September 2007 S collected H and drove him there. Shortly after their arrival in Sheffield the police entered the premises.

H was found in one room, and S in another. S was alone in the same room as a computer. The key to an encrypted file appeared to have been partially entered. He was arrested, and when interviewed, made no comment. In the meantime his home address in London was searched. The search revealed computer material. Various documents had been deleted from the computer hard drives, but when retrieved, they provided the basis for charges against S under section 58 of the Terrorism Act 2000, that is, possessing documents or records of information of kind likely to be useful to a terrorist or potential terrorist. However without the encryption keys for the encrypted files present on the computer hard drives, and indeed the full key for encrypted file on the laptop on which the encryption key appeared to have been already partially entered in Sheffield, the encrypted files could not be accessed and their contents examined.

A was also arrested on 9 September. Computer material was later seized from his address by the police. One of the discs seized has an encrypted area. Without the encryption key access cannot be gained to it.

Both appellants were charged on 10^th September 2007 with conspiracy to breach the control order imposed on H In December 2007 S was arrested while in custody, and following an interview in which he declined to answer any questions, he was charged with offences under section 58 of the 2000 Act. While subject to these charges, on 16 January 2008, S was served with two notices under section 53 of RIPA, and a similar notice was served on A on 15 March 2008.

The first notice served on S immediately identified the purpose, the “investigation of protected electronic information”, and after explaining that the notice imposed a legal obligation, failure to comply with which was an offence, it continued:

“Disclosure requirement

… I hereby require you to disclose a key or any supporting information to make information intelligible

the information to which this notice relates is:

the full encryption key in order to access the encrypted volume of the laptop computer that is exhibited as exhibit AM/1 under file path: C:\Documents and Settings\Administrator\My Documents\My Videos, within a file called Ronin.wma. This was found in the room where you were arrested at 386 Abbeydale Road, Sheffield”.

The reason for the notice was explained, with particulars given of the precise circumstances in which the interests of national security and the prevention or detection of crime were said to arise.

The notice then described how

“disclosure can be verbal or written provided the information is sufficient to unlock the encryption, and that the person to whom the notice is given may select which of any relevant keys or combination of keys should be disclosed provided the information is put into intelligible form.”

The remaining notices were in identical terms, appropriate to the electronic information identified in them.

Neither S nor A complied with the notices. Their position was that the notices which compelled them to disclose the passwords or “keys” to the encrypted computer files were incompatible with the privilege against self-incrimination. Their refusal formed the basis of the counts in the indictment which Judge Stephens was invited to stay on the basis that “the requirement to provide information to the police under Part III of RIPA constituted an impermissible infringement of the …privilege against self-incrimination” and contravened article 6 of the European Convention of Human Rights. In a careful ruling Judge Stephens rejected the applications. Applications for leave to appeal against his decision were referred to the full court by the Registrar of Criminal Appeals. After full argument leave was granted but the appeals dismissed.

The 2000 Act provides the current, comprehensive regulatory structure which governs the interception of communications, surveillance activities, access to communications data and decryption of encrypted material. Section 49 of the Act creates the power to require disclosure of “any protected information” which means

“…any electronic data which, without the key to the data –

(a)

cannot, or cannot readily, be accessed, or

(b)

cannot, or cannot readily, be put into an intelligible form”

The exercise of the power however is subject to compliance with extensive pre-conditions which must be demonstrated to the satisfaction of a judge without whose permission the notice cannot be given.

Section 49 (1) ensures that the protected information to which any notice relates must have been lawfully acquired whether “by means of the exercise of a statutory power” or “any other lawful means”. Section 49(2) requires the application to be based on reasonable grounds for believing

“…

(a)

that a key to the protected information is in the possession of any person,

(b)

that the imposition of the disclosure requirement in respect of the protected information is –

(i)

necessary on grounds falling within sub-section (3) or

(ii)

necessary for the purpose of securing the effective exercise of proper performance by any public authority of any statutory power or statutory duty

(c)

that the imposition of such a requirement is proportionate to what is sought to be achieved by its imposition and

(d)

that it is not reasonably practicable for the person with the appropriate permission to obtain possession of the protected information in an intelligible form without the giving of a notice under this section, …”

For the purposes of this section necessity is closely defined by section 49(3) and is limited to

“….(a).. the interests of national security;

(b)…the purpose of preventing or detecting crime; or

(c)..the economic wellbeing of the United Kingdom”.

In short, the exercise of the notification process is predicated on the basis that electronic data which cannot readily be accessed or made intelligible without the key to it is already lawfully in the possession of the police (or other similar authority) and that the interests of national security or the prevention or detection of crime necessarily require its disclosure because no alternative, reasonable method of gaining access to it or making it intelligible is available. The disclosure request, and the consequent obligation imposed on the individual to whom it is addressed, must also be proportionate to its intended objective. The exercise of the power to require disclosure in these circumstances anticipates at least the potential for disclosure of information which may inculpate the individual to whom the notice is addressed: hence, no doubt, the statutory conditions and limitations on its exercise.

Failure, knowingly, to make the disclosure required by a notice lawfully issued under section 49 is a criminal offence, punishable on conviction with imprisonment, in a case involving national security, for a maximum term of 5 years, and in any other case, 2 years’ imprisonment.

The submission on behalf of the appellants contained a number of different strands, said to be supported by a variety of different authorities; but on analysis, they all derive from and the essence of the submission is the privilege against self-incrimination. It is perhaps noteworthy that the submission assumes that the disclosure of the key to the protected data in the possession of the appellants would incriminate them, and indeed in the case of S, may provide evidence supportive of the prosecution case against him under section 58 of the Terrorism Act. There is no direct evidence before us that it would, and no admission to that effect has been made by the appellants. But we were invited to proceed on the basis for the purposes of this argument that if the appropriate key were provided, incriminating material may be discovered.

Judge Stephens decided that the privilege against self-incrimination was not engaged on the basis that the material in question had a separate existence, independent of the minds of the appellants, and in any event, that the proposed incursion into the privilege against self-incrimination (if any) was legitimate and proportionate.

The privilege against self incrimination is deeply rooted in the common law. “No one is bound to answer any question if the answer thereto would, in the opinion of the judge, have a tendency to expose (him) to any criminal charge, penalty or forfeiture which the judge regards as reasonably likely to be preferred …” (per Goddard LJ in Blunt v Park Lane Hotel [1942] 2 KB 53 at 257). Article 6 of the European Convention of Human Rights encompasses the same protection against self-incrimination. “The right to silence and the right not to incriminate oneself, are generally recognised international standards which lie at the heart of the notion of a fair procedure under article 6….the right not to incriminate oneself, in particular, presupposes that the prosecution in the criminal case seek to prove their case against the accused without resort to evidence obtained through methods of coercion or oppression in defiance of the will of the accused. In this sense the right is closely linked to the presumption of innocence contained in article 6(2)” (Saunders v UK [1996] 23 EHRR 313).

It is well understood that the principle is subject to numerous statutory exceptions which limit, amend, or abrogate the privilege in specified circumstances. Thus, notwithstanding the privilege, individuals may sometimes be required to answer questions or provide information or documents which may incriminate them. As Lord Mustill explained in R v Director of Serious Fraud Office ex parte Smith [1993] AC 1, in relation to the general immunity against answering incriminating questions,

“Few would dispute that some curtailment of the liberty is indispensable to the stability of society; and indeed in the United Kingdom today our lives are permeated by enforceable duties to provide information on demand…”

In some cases the use which may be made of any such information or answers in the course of distinct criminal proceedings is closely limited (see for example, section 98 of the Children Act 1989) and in others the answers may provide direct evidence to support a subsequent prosecution (for example, section 172 of the Road Traffic Act 1988). In the Police and Criminal Evidence Act 1984 detailed structures are created to govern the provision of intimate samples (such as samples of blood and pubic hair) and non intimate samples (such as non-pubic hair) and the need for and consequences of the absence of consent (where consent is required) or non-compliance (where it is not). In short, statutory provision has been made both to enable information provided or answers given in response to a statutory obligation to do so to be used in evidence in support of a subsequent prosecution, and for the failure or refusal to comply with a request for information, properly made, itself to constitute a criminal offence with consequent sanctions. In Brown v Stott [Procurator Fiscal, Dunfermline] and another [2003] 1 AC 681 the privilege against self incrimination, which was described as a right implied from albeit not expressly referred to in article 6 of the Convention, was held not to be absolute, and to be subject to limited qualifications where necessary to achieve a legitimate public interest. Lord Bingham explained the effect of the jurisprudence of the European Court

“…that while the overall fairness of a criminal trial cannot be compromised, the constituent rights comprised, whether expressly or implicitly, within article 6 are not themselves absolute. Limited qualification of these rights is acceptable if reasonably directed by national authorities towards a clear and proper public objective and if representing no greater qualification than the situation calls for”

In these circumstances it was not submitted that the privilege against self incrimination is absolute, nor that the offence created in the context of Part III of RIPA is incompatible with article 6 of the European Convention.

The first question which arises in an individual case, however, is not whether the statutory exceptions to the principle against self-incrimination properly apply, but whether the principle itself is engaged at all. The European Court in Saunders v UK explained that

“the right not to incriminate oneself …does not extend to the use in criminal proceedings of material which may be obtained from the accused through compulsory powers but which have an existence independent of the will of the suspect, such as, inter alia, documents acquired pursuant to a warrant, breath, blood and urine samples and bodily tissue for the purpose of DNA testing”.

The principle that evidence existing independent of the will of the suspect does not normally engage the privilege against self-incrimination is clearly established in domestic law. It was applied in Attorney-General’s Reference (No7 of 200) [2001] 2 CAR 286, R v Kearns [2003] 1 CAR 111 and R v Hundall and Dhaliwal [2004] 2 CAR 307 where the court cited, with approval, the judgment of Aikens J at paragraph 53 in Kearns that

“There is a distinction between the compulsory production of documents or other material which have an existence independent of the will of the suspect or accused person and statements that he has had to make under compulsion. In the former case there is no infringement of the right to silence and the right not to incriminate oneself. In the latter case there could be, depending on the circumstances”

The same reasoning was applied in C plc v P [2007] 3WLR 437 and was addressed but not decided in Re A [2008] EWHC 1362 (Admin), in which the ratio of the decision in C plc v P was applied.

These authorities, and many of the other authorities cited to us, meant that the debate in argument concentrated on the rival contentions whether the key to each appellants’ protected data was properly to be catalogued as a piece of information with an existence separate from his “will”. The problem which presents itself in the present appeals, is not, in our judgment, susceptible of quite such rigid compartmentalisation.

On analysis, the key which provides access to protected data, like the data itself, exists separately from each appellant’s “will”. Even if it is true that each created his own key, once created, the key to the data, remains independent of the appellant’s “will” even when it is retained only in his memory, at any rate until it is changed. If investigating officers were able to identify the key from a different source (say, for example, from the records of the shop where the equipment was purchased) no one would argue that the key was not distinct from the equipment which was to be accessed, and indeed the individual who owned the equipment and knew the key to it. Again, if the arresting officers had arrived at the premises in Sheffield immediately after S had completed the process of accessing his own equipment enabling them to identify the key, the key itself would have been a piece of information existing, at this point, independently of S himself and would have been immediately available to the police for their use in the investigation. In this sense the key to the computer equipment is no different to the key to a locked drawer. The contents of the drawer exist independently of the suspect: so does the key to it. The contents may or may not be incriminating: the key is neutral. In the present cases the prosecution is in possession of the drawer: it cannot however gain access to the contents. The lock cannot be broken or picked, and the drawer itself cannot be damaged without destroying the contents.

As it happens, in the present cases, the only persons who know how to access the data to which access is being sought are the appellants themselves. Assuming, as for present purposes we have, that the computers contain material which may incriminate each appellant, whether by lending weight to the Crown’s case against them on the remaining counts in the indictment, or providing a basis for further criminal charges whether contrary to the Terrorism Act or otherwise, disclosure by them of the keys would tend to make material available to the prosecution which would incriminate them. Non-disclosure would altogether prevent the incriminating material from coming to light. In short, the notice issued under section 49 of RIPA requires the appellants, under threat of criminal proceedings for non-compliance, to speak or write or otherwise convey sufficient information to the police to enable them to access the contents of their computers. The actual answers, that is to say the product of the appellants’ minds could not, of themselves, be incriminating. The keys themselves simply open the locked drawer, revealing its contents. In much the same way that a blood or urine sample provided by a car driver is a fact independent of the driver, which may or may not reveal that his alcohol level exceeds the permitted maximum, whether the appellants’ computers contain incriminating material or not, the keys to them are and remain an independent fact. If however, as for present purposes we are assuming, they contain incriminating material, the fact of the appellants’ knowledge of the keys may itself become an incriminating fact. For example, to know the key to a computer in your possession which contains indecent images of children may itself tend to support the prosecution case that you were knowingly in possession of such material. This was the approach adopted in Re Boucher, a decision of the District Court in Vermont [2007] WL 4246473, where the reasoning acknowledged that some “acts of production” such as fingerprints, blood samples or voice recordings would not attract the privilege against self-incrimination.

Mr Ryder highlighted the decision of the Grand Chamber of the Court in Jalloh v Germany [2007] 44 EHRR 32 where it was recently asserted that even evidence which may properly be described as “independent of the will of the suspect” which has been obtained by inhuman or degrading treatment may constitute a breach of the entitlement to a fair trial. In this jurisdiction such an issue would be likely to give rise to the exercise of the court’s jurisdiction, under section 78 of the Police and Criminal Evidence Act 1984, to refuse to allow evidence to be given by the prosecution when the circumstances in which it was obtained undermined the fairness of the proceedings. In making such a decision, the court would no doubt attend very closely to any circumstances amounting to oppression as defined in section 76 of the 1984 Act, or inhuman or degrading treatment to which the suspect was subjected, and if such circumstances were found, would step in to protect the defendant’s entitlement to a fair trial. When an examination of the jurisprudence of the European Court into the principles relating to self-incrimination and the fairness of any subsequent trial is conducted, this common law discretionary power, which long pre-dated its incorporation into statute, should not be minimised.

Mr Ryder suggested that the protection provided by section 78 did not arise at this stage in the argument: it could only arise for consideration at trial after the appellant had been forced to incriminate himself. In our judgment, however, as Lord Bingham explained in Brown v Stott, the jurisprudence of the European Court is directed at the overall fairness of the trial and Jalloh should be seen as a decision which maintains the same principle. Evidence obtained by ill-treatment of the kind to which Jalloh was subjected may, and normally would be excluded. That is precisely why the common law rule, now embodied in section 78, exists. In this context, Jalloh is no more than an illustration of precisely the same point.

In our judgment the correct analysis is that the privilege against self-incrimination may be engaged by a requirement of disclosure of knowledge of the means of access to protected data under compulsion of law. If Judge Stephens ruling treated this knowledge as identical to the key to it, we respectfully disagree. But where, in the end, would this take the appellants? It is noteworthy that, although the detailed arguments purported to address the means of access to what would otherwise be protected data, the reality is that it is the contents of the equipment containing that data, lawfully in the possession of the police, which the argument is designed to protect from disclosure and possible use in the course of a prosecution, rather than the keys to it. In short, although the appellants’ knowledge of the means of access to the data may engage the privilege against self-incrimination, it would only do so if the data itself – which undoubtedly exists independently of the will of the appellants and to which the privilege against self-incrimination does not apply – contains incriminating material. If that data was neutral or innocent, the knowledge of the means of access to it would similarly be either neutral or innocent. On the other hand, if the material were, as we have assumed, incriminatory, it would be open to the trial judge to exclude evidence of the means by which the prosecution gained access to it. Accordingly the extent to which the privilege against self-incrimination may be engaged is indeed very limited.

In these appeals the question which arises, if the privilege is engaged at all, is whether the interference with it is proportionate and permissible. A number of issues are clear and stark. The material which really matters is lawfully in the hands of the police. Without the key it is unreadable. That is all. The process of making it readable should not alter it other than putting it into an unencrypted and intelligible form that it was in prior to encryption; the material in the possession of the police will simply be revealed for what it is. To enable the otherwise unreadable to be read is a legitimate objective which deals with a recognised problem of encryption. The key or password is, as we have explained, a fact. It does not constitute an admission of guilt. Only knowledge of it may be incriminating. The purpose of the statute is to regulate the use of encrypted material, and to impose limitations on the circumstances in which it may be used. The requirement for information is based on the interests of national security and the prevention and detection of crime, and is expressly subject to a proportionality test and judicial oversight. In the end the requirement to disclose extends no further than the provision of the key or password or access to the information. No further questions arise. The notice is in very simple form. Procedural safeguards and limitations on the circumstances in which this notice may be served are addressed in a comprehensive structure, and in relation to any subsequent trial, the powers under section 78 of the 1984 Act to exclude evidence in relation, first, to the underlying material, second, the key or means of access to it, and third, an individual defendant’s knowledge of the key or means of access, remain. Neither the process, nor any subsequent trial can realistically be stigmatised as unfair.

In these circumstances we can find no basis for interfering with Judge Stephens’ indication of how he would have exercised his discretion if, contrary to his view, an issue of self-incrimination arose. In the circumstances of this particular case his conclusion was obviously correct. Furthermore, by way of emphasis, we can see no possible ground for a successful application that the prosecution under section 53 of RIPA should be stopped as an abuse of process.

By way of footnote: if the self-incrimination argument was taken as a matter of principle on the basis of legal advice to the appellants, and they choose, now, to disclose the relevant key, although long out of time, we suspect that the prosecution would be disinclined to proceed with the appropriate counts in the indictment, or if they chose to do so, that the judge would take a merciful view when addressing sentence, at any rate if the protected data turned out to be innocent or simply neutral.