|Mr. Oliver Heald||Mr. Charles Clarke|
|... Justice and the
Foundation for Information Policy Research have provided the Committee
with a barrister's opinion from Tim Eicke. On 23 March, I suggested to
the Minister that it might be helpful if a Law Officer could attend the
debate, but I understand that that will not occur.
...In the past, the Labour party took a rather different view of encryption. In its 1995 policy paper ``Communicating Britain's Future'' it stated:
The only power we would wish to give to the authorities, in order to pursue a defined legitimate anti-criminal purpose, would be to enable decryption to be demanded under judicial warrant (in the same way that a warrant is required in order to search someone's home).
...At that time, the Labour party was prepared to contemplate it only under judicial warrant. That has clearly changed.
...lawyers have described the repugnant nature of the offence created, which requires no guilty intention to ground a conviction. In most offences such a guilty intention is required. With theft, for example, the prosecutor has to prove that the person has acted dishonestly and has that intention or mental state....
As Tim Eicke points out,
He refers to the views expressed by the Lord Chief Justice in the case ex parte Kebeline in 1999, which was dealt with at divisional court level. He also referred to a Canadian case, Regina v. Whyte, which has a persuasive authority in this country as it is from another common law jurisdiction with English law as its base. Chief Justice Dickson said:
He went on to point out that there are other possible infringements of privilege against self-incrimination and a perverse incentive not to admit to ownership of a key.
The prosecution could prove facts that are entirely neutral about whether the person has any guilty intention. A person who has not complied with a notice but has had the key may have simply discarded the key or forgotten it. Keys are often discarded for sensible security reasons. The worry is that the burden of proof will be reversed for the defences in the clause. A person is being asked to prove something, whereas the prosecution need only prove facts that are entirely neutral as between guilt and innocence.
...The Minister has been asked many questions about the clause. How will those served with written notices under the current clause, which requires plaintext or encryption keys, successfully show that they cannot comply with the notice? The Trade and Industry Committee asked that question in its 14th report on 26 October last year. Caspar Bowden, of the Foundation for Information Policy Research, asked how it was possible to prove, on the balance of probabilities, that a key has been lost or forgotten. I should be grateful if the Minister would answer that.
I expect the Minister to say that the burden of proof has not been reversed. He may argue that, because certain things must be proved, there is a burden on the prosecution. He may say that it will be necessary to prove service, non-compliance and that the person has or has had the key. All those, however, are equally consistent with a guilty and a not guilty intention. Will the Minister accept that there is a burden on the accused to establish innocence, against a background of the prosecution proving neutral facts?
Another question is whether the notice, and therefore the offence, is compliant with the European convention on human rights. Will the Minister flesh out his views on that? Much in the Tim Eicke opinion suggests that it might not be. The Minister may say that the courts will decide whether it is reasonable for a person to have lost his key. Will he accept that they will decide that only on the basis that the defendant must prove it? Usually, if there is a reasonable doubt, the accused is entitled to be acquitted.
The Minister may say that, according to the Kebeline case, not all reverse burdens are incompatible with the European convention on human rights. I challenge the Minister on that because their lordships expressly left the question to be decided by the trial judge in subsequent appeals. I should be grateful if the hon. Gentleman would confirm that the Kebeline decision does not mean that the courts have decided that all reverse burdens are not incompatible with the European convention on human rights.
The Minister may also say that many criminal offences place a burden on the defendant. If the Minister has studied those cases, he may agree that they are either restricted to the type of terrorist cases in Kebeline in which a person had documents in his possession and there was a reasonable suspicion that they might be used for terrorist purposes - very specialist examples - or minor offences such as failing to display a tax disc. Most people would accept that it is public policy to ensure that everyone displays a tax disc, and that if someone is convicted he is not likely to be sentenced heavily. Does the hon. Gentleman agree that he is adopting a most unusual procedure, and for that reason it is unsatisfactory?
|I shall make no concessions.
...The allegation is that the offence of failing to comply with a disclosure notice reverses the burden of proof to the extent that it is incompatible with article 6(2) of the European convention on human rights, which concerns the presumption of innocence.
It is said that it is easy to forget a password or key and difficult to prove a negative in that a person does not have something. The central charge that is made is that innocent people may suffer in such circumstances...
I believe strongly that the provisions are compatible with the European convention on human rights. My right hon. Friend the Home Secretary has signed a section 19 statement to that effect. It is not a frivolous undertaking.
...the legal advice upon which the Home Secretary has signed a section 19 statement is an equally valid - I would argue that it is more valid-opinion...
It will be for the court to decide in any particular instance whether on the balance of probabilities a person has, for example, forgotten a password - that example has been widely discussed. There are many offences on the statute book that place burdens on the accused. Our approach in this context is to argue that a person who has been shown beyond reasonable doubt to have had the key in his possession is presumed still to have that key unless it can be shown on the balance of probabilities that he no longer has it.
That is the situation in terms of the legal burden of proof, but I want to discuss it in terms of common-sense understanding and to explain what will happen in particular cases. I agree with the hon. Member for Hallam that it is helpful to consider examples. I hope that that reinforces the point that I have made on several occasions that the offence does not reverse the burden of proof. It places a lesser burden on the defence, which is entirely appropriate. That approach is replicated in relation to many other offences. Let me explain why.
The real issue concerns not the reversal of the burden of proof but whether the individual in question can show on the balance of probabilities that he no longer has access to the key. The nature of emerging encryption technologies means that proving, even on the balance of probabilities, that one does not have the key at the relevant time could be a tricky proposition.......
There are two clear different circumstances, the first of which involves the case of a business. The business, which is responsible and secure, always has back-up mechanisms, always anticipates the loss of a key and always has an audit trail that establishes when keys were used for what purposes and when they were thrown away. We have got that message strongly from talking to business, and it is entirely reasonable to have such expectations. The hon. Member for Esher and Walton mentioned the possibility that some might choose the approach that is associated with key escrow. That is a different way to secure a rigorous system that pursues and tracks keys.
If a business found itself in that position - I emphasise, by the way, that I doubt whether it would-and had to show, on the balance of probabilities, that it did not have the key at the relevant time, it could wheel in any number of technical records to explain the circumstances under which it normally disposes of keys to produce evidence to that effect. Businesses are in a good position in this regard because their conduct will normally be supported by substantial records.
What about the individual.... who simply forgets his password? As critics have said, that is a very reasonable thing to do - many people do so in many different circumstances. We should bear in mind that the individual has to demonstrate his forgetfulness only on the balance of probabilities, which means that he is already some way there. It is a reasonable explanation for him to say that he has forgotten his passport-I keep saying ``passport''; I mean ``password''-[Laughter.] I confess to having the Home Office disease. ``Password'' is the word what I want.
Precisely because forgetting a password is such a reasonable thing to do, it is rare that there are no contingency arrangements for such an eventuality. Depending on the circumstances of the case and the reasons why the material was acquired in the first place, individuals could easily state that they had forgotten their password or key, but volunteer information about the last time they remembered it, what they normally do when they forget it, whether their service provider has a back-up system or whether all data are destroyed every time that they lose their key. The court will take such factors into account. I think that that represents a perfectly reasonable set of events. I emphasise again that there is no reversal of the burden of proof. Once the prosecution has proved possession beyond reasonable doubt, the defence can avoid liability by demonstrating a change of circumstances on a balance of probability.
The burden of proof is not reversed and the maximum two-year sentence is entirely appropriate. On that basis, the new clauses should not be accepted.
...I realise that I have not responded to the point made by the hon. Member for Hallam about hard disk failure and the destruction of a key in those circumstances. If the key is not available, the Crown Prosecution Service will not bring a prosecution. I am confident that the courts can distinguish between the loss of keys or an IT failure of this type and an attempt by the holder to destroy the key.