A UK law enforcement agency asked a court to force alleged hacker Lauri Love to reveal passwords for computers they confiscated. The Court said no. The problem? That would bypass human rights safeguards UK Parliament built into investigatory powers laws.
Love is suspected of hacking computer systems of the US Army, US Federal Reserve (their central bank (equivalent of the UK’s Bank of England)) and NASA (the US National Aeronautics and Space Administration). If extradited to the US, Love could face up to 99 years in prison.
The computer scientist was allegedly involved in #OpLastResort: online protests organised by hacker-activist network Anonymous following the persecution and suicide of American internet rights activist, Aaron Swartz. Swartz was accused of fraud and various computer misuse offences. He was facing a $1 million fine and up to 35 years in prison when he took his own life aged 26. Swartz’s family described the accusations against Swartz as “the product of a criminal justice system rife with intimidation and prosecutorial overreach“.
What the court was asked to do
The UK’s National Crime Agency (NCA) seized several devices from Lauri Love’s home in Suffolk in October 2013. Love was not charged with any offences and he applied in 2015 for the devices to be returned to him. In 2016, the NCA asked Westminster Magistrates’ Court to order Love to disclose passwords for three computers which were taken from his home.
Love objected to the NCA’s request, arguing that the proper procedure was an application under Part III of the Regulation of Investigatory Powers Act (RIPA). He said that the NCA’s application to court was an attempt to circumvent that legislation, which contains important safeguards around obtaining information. Such safeguards include a reasonable belief that requiring disclosure is necessary and a proportionate measure.
Love argued that avoiding the RIPA procedure would breach his rights to enjoyment of property (under Article 1 Protocol 1 of the European Convention on Human Rights) and to respect for private life (under Article 8 of the European Convention on Human Rights). These rights take effect in UK law through the Human Rights Act.
What did the court decide?
District Judge Nina Tempia refused to grant the NCA’s application. The court would not order Love to disclose the computer passwords to the NCA because “in order to obtain the information sought the correct procedure to be used, as the NCA did 2 ½ years ago, is under… RIPA, with the inherent Human Rights Act safeguards incorporated”. The court’s powers were not to be used to “circumvent specific legislation that has been passed in order to deal with the disclosure sought”. In other words, the NCA couldn’t use an application to the court to get around the human rights safeguards that are built into the UK’s investigatory powers legislation.
Learn more about the right to private life and to peaceful enjoyment of property by clicking the links in this paragraph. Read our recent post on data privacy and the possible threat from ‘Big Data’ here.