ENCRYPTION (No. 2)

HC Deb 03 November 2003 vol 412 cc584-91

'A person convicted of an offence under section 1 of the Child Protection Act 1978 and subsequently convicted of an offence under section 53 of the Regulation of Investigatory Powers Act 2000 is on the second conviction on indictment liable to—

1. (a) a term of imprisonment not exceeding seven years, or
2. (b) a fine, or
3. (c) both.'.—[Sir Paul Beresford.]

Brought up, and read the First time.

Sir Paul Beresford

I beg to move, That the clause be read a Second time.

Mr. Deputy Speaker

With this it will be convenient to discuss the following: new clause 8—Encryption (No.3)—

"1. section 53 of the Regulation of Investigatory Powers Act 2000 there shall be inserted— 53A Subsequent failure to comply with a notice where protected data likely to be indecent images (1) Where the first and second conditions below are satisfied, section 53 of this Act shall apply as if the penalties were—

1. (a) on conviction on indictment, to imprisonment for a term not exceeding seven years or to a fine, or to both;
2. (b) on summary conviction, to imprisonment for a term not exceeding six months or to a fine not exceeding the statutory maximum, or to both

and the offence shall be treated as a relevant offence for the purposes of Part II of the Sexual Offences Act 2003. (2) This first condition is—

1. (a) a person has been previously convicted of an offence contrary to section 53 of this Act, and
2. (b) that person has been previously convicted of an offence contrary to section 1 of the Protection of Children Act 1978 or section 160 of the Criminal Justice Act 1988.

(2) The second condition is a further notice has been issued under section 49 of this Act.".'. Amendment No. 190, in page 26, line 16 [Clause 46], at end insert— '(5) Section 5 of the Protection of Children Act 1978 (c.37) shall be amended as follows— (a) After subsection (6) shall be inserted—

1. "(6A) Where a person is convicted or cautioned in respect of an offence under section 1(1) of this Act, then any equipment that has been used to take, make, store or distribute indecent images of children shall be forfeited.
2. (6B) Section 14(1) of the Powers of Criminal Court (Sentencing) Act 2000 (c.6) shall not apply for the purposes of this section.
3. (6C) Where equipment has been the subject of forfeiture under section (6A) above, a person, other than the person convicted under section 1, shall be entitled to apply to the relevant magistrates' court for return of the equipment if—
1. (a) the equipment forfeited belonged not to the person convicted under section 1 but to the applicant, and
2. (b) the applicant did not have knowledge of the taking, making, storing or distributing of indecent images of children, nor could he be reasonably expected to have known.
4. (6D) The burden of proof for the purposes of section (6C) shall be on the applicant, and the standard of proof shall be the preponderance of probabilities.
5. (6E) Where the court is satisfied that the conditions set out in (6C) above are met, they may order the return of the equipment to the applicant so Long as any indecent images that remain on the equipment can be permanently erased."
6. (b) In the first line of subsection (7) the words "(2), (6) or (6A)" shall replace "(2) or (6)".'.

Government amendments Nos. 83 and 84.

Sir Paul Beresford

New clauses 7 and 8 and amendment No. 190 are the result of what happened in Committee, where I raised the issue of encryption because I was beginning to become aware of the difficulties that it involves. Encryption is already recognized as a problem under part II of the Regulation of Investigatory Powers Act 2000—RIPA, for short— under which the maximum sentence for failing to produce a code to obtain access to encrypted material is two years.

Anyone with an interest in the activities of pedophiles knows that they collect volumes of pictures and videos of children being sexually abused, and that they film themselves. Such things are quite horrendous and it would be inappropriate for me to continue talking about them as it is not yet 8 pm. Paedophiles use such material for self-stimulation, to join paedophile groups and as a means to purchase photos, drawings and films, which are frequently kept digitally on computers, remote servers, floppy discs, CD-ROMs, storage pens and digital versatile discs. If a person is convicted of possessing such material, the sentence is usually considerably more than two years, and if the material becomes available to the police, the individual runs the risk of being prosecuted for other offences. An individual who is pressed to reveal the encryption code for such material is most unlikely to do so because if he failed to do so he could only be sentenced to two years under RIPA, and would not be put on the sex offenders list.

The Home Office and the police have told me that they try to break the encryption, which can be done in various ways and by several agencies, including national agencies. An expert who works for the Home Office and the police told me that 80 percent. of codes have been broken so far, which means that 20 percent have not been broken. However, I have some doubt about the figure of 80 percent because information that I have received from the police shows that materials that are sent for code breaking often do not return and, if they do, there is only a 50:50 chance that the code will be broken. De-encryption also costs a lot of money and takes a long time.

I spoke to an expert from the private sector about this matter. He smiled quietly and pointed out that the technology has reached the stage of using 128-bit encryption, which is effectively impossible to break. There are now programmers to achieve 256-bit encryption and, even more worryingly, they are available to download for free from the internet. Although the programmes are slightly complicated, they are rapidly becoming easier to use.

The new clauses would provide that if individuals who had been convicted of sex offences against children failed to give an encryption code, they would face a sentence considerably lengthier than the current two-year sentence under RIPA. I would hope that the threat of a potential seven-year sentence would inspire such individuals to save the police and de-encryption individuals and groups a lot of time and money by coming forward with information, although I appreciate that one would not expect 100 per cent. of people to react to that.

The Minister listened with interest to the debate on encryption in Committee and we heard soothing noises and were told that the Government would come back to it, which is why I have tabled two new clauses. I hope that he is positive about choosing one of them and although I suspect that I am being more hopeful than anything, one can but hope that he will react in such a way.

Amendment No. 190 is quite simple and its provisions were discussed in Committee. When the police take information technology equipment from individuals who are charged with sexual offences against children, they use it to assist their investigation of the crime. Details of the data are often used in the court case. In practice, the police generally keep the equipment, often even if the owner is cautioned rather than convicted. That happens because returning the equipment to the individual would go against natural justice. It would be rather like giving lollies back to a child, if that is not bad phraseology, because it would give individuals the opportunity to return to their activities. As any IT technician knows, even if attempts are made to erase data, it is quite possible for erased data to be restored. If the data are encrypted, the police have no surety that they are destroying the material or clearing the discs.

6.45 pm

I am sure that hon. Members are aware that accidents happen: hard discs can get dropped and, as the Minister said to me one evening, there is nothing like the effect of a sledgehammer. However, an individual could technically ask the police to return the equipment, which they must do under the current law. I have tabled amendment No. 190 because I hope that the Government will accept that the police need the law to go a little further so that such equipment would be confiscated after caution or conviction.

Mr. Grieve

I shall not take up the House's time at length, save to say that I entirely support the new clauses tabled by my hon. Friend the Member for Mole Valley (Sir Paul Beresford). New clause 8 relates to the extent to which individuals might try to hide behind encryption given that the sentence for non-co-operation is so much shorter than the sentence that would be received if the full offence were disclosed when the material was found, which will cause the House anxiety. Even if the Minister cannot accept the new clauses, I hope that he will give us a positive response and say that the issue will be considered. Given the growth of internet use, and especially the use of the internet for paedophile pornography, the problem is serious and it will grow unless the Government do something to solve it. The only way to do that is to ensure that people who do not co-operate by providing encryption keys in such cases are not given an advantage. I appreciate that the new clauses might pose some problems but the police usually know when they are investigating child pornography and paedophiles. In such circumstances, it is not beyond the wit of the House to construct an amendment to address that.

Amendment No. 190 also relates to a real worry. I am especially troubled by the fact that I have been told—I am sure my hon. Friend has too—that it is almost always possible for a person with technical expertise to retrieve deleted material from a hard drive. Given that many who are interested in child pornography have expertise in the field of computers, there would be a risk that if we handed back equipment, the information remaining after the deletion process could be misused. I hope the Minister will look favourably on the amendment.

Sandra Gidley

I rise briefly to support the new clauses and amendment tabled by the hon. Member for Mole Valley (Sir Paul Beresford), although 1 do not think anything would be gained by prolonging the debate on them. However, I also want to make a point that was mentioned in Committee relating to Government amendments Nos. 83 and 84. We are clear about the situation regarding photographs, pseudo—photographs and images, but the Bill does not cover written material that describes paedophilia or other aspects of sexual behaviour that we might find distasteful.

I do not think that the Minister for Citizenship and Immigration understood what I was talking about in Committee. That reassures me greatly because it probably means that she has led a sheltered life. Fairly foul material exists that graphically describes sexual acts in a way that is probably best not described. That material could encourage anyone with an interest in child sex or child exploitation to go over the edge and try it for themselves. Have the Government considered dealing with such material? If so, why is there nothing in the Bill to that effect? If not, perhaps they could think about it because it has been overlooked.

Paul Goggins

Government amendments Nos. 83 and 84 will create a limited defense to a charge of making an indecent photograph or pseudo-photograph of a child under section 1(1)(a) of the Protection of Children Act 1978 when it is done for one of the specified purposes: for the detection, investigation or prevention of crime; for criminal proceedings; or by those who carry out the functions of the security service or GCHQ. That defense replaces the authorization scheme.

I remind the House of the purpose of clause 47. There is no statutory defence to making indecent photographs of children. In the normal course of an investigation, the police and others, such as Internet Watch Foundation staff and systems administrators, need to access internet sites where they believe they will find indecent photographs. Their work will involve them in downloading and thus making the indecent photographs. After discussions with the police and representatives of the industry, the authorization scheme that we originally drew up has been shown to be unduly burdensome to the police and subject to delays owing to the potential number of applications for such authorization.

The amendment creates a limited defence for specified purposes. A person shown to have made an indecent photograph or pseudo-photograph of a child will have to prove, on the balance of probabilities, that it was necessary for him to do so for one of the specified purposes. That represents the right balance, allowing those who need to act to do so while preserving a very significant obstacle to misuse by paedophiles. We acknowledge that companies wishing to assist the police may require further reassurance that their actions will be viewed as complying with the defence, so as to avoid the risk of lengthy investigation and possible prosecution. We intend that the defence will be backed up by a clear code of practice involving the Crown Prosecution Service, the police. the Internet Watch Foundation and the industry in general, setting out in sufficient detail the way in which such judgments will be made. Such a code is best made on a non-statutory basis as it will need to be adjusted swiftly to reflect changes in technology and investigative techniques.

Mr. Grieve

I welcome Government amendments Nos. 83 and 84, which reflect the concerns of internet service providers. They are a great improvement. The industry remains anxious about some matters. I am convinced that the code will alleviate that anxiety, but it needs to be drawn up after good consultations with the industry, which needs to be reassured that it will be able to copy and make images for the purpose of helping in the investigation of crime.

Paul Goggins

I am grateful for the hon. Gentleman's support. If the authorization system is overly burdensome it will not be enough simply to have the defence that we propose without the wider context of the code and the support that that will afford. Clearly the code will need to give people who do that job the confidence to act. As I said several times in Committee, none of us would wish to do their job. So I commend amendments Nos. 83 and 84 to the House.

Again, I have to disappoint the hon. Member for Mole Valley (Sir Paul Beresford) by telling him that I resist amendment No. 190, on forfeiture. It has been introduced following an admittedly brief debate in Committee. My hon. Friend the Minister for Citizenship and Immigration acknowledged that there is an issue to be addressed and agreed that we would consider the position to see whether we could introduce our own proposals. Although I cannot accept the hon. Gentleman's proposals as they stand, I regret that so far we have been unable to resolve all the issues ourselves. However, I assure him and the House that we will continue to work on that problem and will introduce proposals at the earliest opportunity. As the hon. Gentleman rightly explained, I own up to belonging to the sledgehammer tendency. I hope that it gives him some comfort that that is my starting point.

The hon. Gentleman rightly identified that the provisions set out in sections 4 and 5 of the Protection of Children Act 1978, which deal with the forfeiture of indecent photographs, do not state specifically how to deal with the equipment that is used t o create, handle or store the data concerned. In attempting to ensure that the equipment is not returned, however, the amendment would create difficulties in some circumstances. For example, if the permanent erasure of the indecent images is not completed to the satisfaction of the court, the equipment could not be returned, even to third parties, possibly causing a substantial loss. Similarly, the amendment would not allow for the fact that valuable data belonging to an innocent third party might be held on a computer owned by the offender and lost to its owner. That could include business accounts and other important data relating to an innocent third party's affairs.

Such issues need consideration and discussion. We have begun that process, but it is not yet complete. We have also identified that further work is needed to close a gap, which the amendment would not do, between the provisions in the 1978 Act and the general forfeiture provision set out in section 143 of the Powers of Criminal Courts (Sentencing) Act 2000. I remain deeply grateful to the hon. Gentleman for his work on the subject. I assure him that we will work hard to resolve all the problems and to introduce proposals to fill the gaps at the earliest opportunity. I regret, however, that we are not at that stage yet and ask for his forbearance.

The objective of new clause 7 is to make an offender contemplate an extended term of imprisonment for failing to disclose electronic information that he has protected. I welcome the link to part III of the Regulation of Investigatory Powers Act 2000. When implemented, the RIPA regime will provide a power to compel the disclosure of protected information, subject to statutory safeguards and oversight. I have to resist the new clause, however. On a technical level, it refers to an offence under section 7 of the 1978 Act rather than section 1, which would be more appropriate. More importantly, however, it does not clearly make the link between the conduct involving indecent images of children and the conduct, in the same investigation, of failing to disclose protected data when required to do so under RIPA. It simply refers to a "subsequent" conviction for a section 53 offence, which could relate to an entirely separate incident from the one in which the indecent photographs were found and could take place many years after the conviction, even when the person had been entirely rehabilitated.

The key consideration must be that the offence of failing to disclose protected information relates directly to the offence involving indecent images. In practice, the conviction for failing to disclose might precede or be simultaneous to the conviction for the indecent photographs offence. I appreciate that the hon. Gentleman may regard my comments as more smooth words, but I am sympathetic to what the amendment attempts to do. As in Committee, I undertake to consider introducing our own proposals, initially in the context of consulting on the implementation of part III of RIPA.

I have to resist new clause 8 for the same reasons as new clause 7, although I understand the concerns that drive the hon. Gentleman to table such amendments. Quite simply, an offence of failing to comply with a RIPA requirement to disclose protected information or the means to access that information cannot be treated as a sexual offence simply because it is a repeat offence and the offender has a previous conviction for a sexual offence.

I hope that those warm words have offered the hon. Gentleman some reassurance. I give him my pledge that I will continue to work very hard on the matter, and I look forward to working with him on the taskforce and in other forums. However, I ask him not to press his new clause and amendments.

7 pm

Sir Paul Beresford

It is going to be an evening of warm words and pledges, but in the circumstances I cannot but accept those offered by the Minister.

Certainly Government amendments Nos. 83 and 84 are welcome. I neglected to say earlier that not only has there been close co-operation in Committee, which seems to be duplicated this evening, but the internet taskforce, which the Minister chairs, and its offshoots have a huge number of experts in various areas, and it may be that the amendments were derived from those experts.

I am sorry that amendment No. 190 is not acceptable, but I am certainly relieved that the sledgehammer tendency will continue and that there is a possibility of Government proposals on this matter. The same applies to the two new clauses.

We have rattled cages again this evening, and the Government have accepted that they need to look into these matters. On those grounds, I beg to ask leave to withdraw the motion.

Motion and clause, by leave, withdrawn.