News

Judge Refuses To Force Alleged Hacker To Reveal His Passwords

By Natasha Holcroft-Emmess, Associate Editor 11 May 2016
Privacy

A UK law enforcement agency asked a court to force alleged hacker Lauri Love to reveal passwords for computers they confiscated. The Court said no. The problem? That would bypass human rights safeguards UK Parliament built into investigatory powers laws.

Love is suspected of hacking computer systems of the US Army, US Federal Reserve (their central bank (equivalent of the UK’s Bank of England)) and NASA (the US National Aeronautics and Space Administration). If extradited to the US, Love could face up to 99 years in prison.

The computer scientist was allegedly involved in #OpLastResort: online protests organised by hacker-activist network Anonymous following the persecution and suicide of American internet rights activist, Aaron Swartz. Swartz was accused of fraud and various computer misuse offences. He was facing a $1 million fine and up to 35 years in prison when he took his own life aged 26. Swartz’s family described the accusations against Swartz as “the product of a criminal justice system rife with intimidation and prosecutorial overreach“.

What the court was asked to do

11847620495_4256ab897c_h

The UK’s National Crime Agency (NCA) seized several devices from Lauri Love’s home in Suffolk in October 2013. Love was not charged with any offences and he applied in 2015 for the devices to be returned to him. In 2016, the NCA asked Westminster Magistrates’ Court to order Love to disclose passwords for three computers which were taken from his home.

Love objected to the NCA’s request, arguing that the proper procedure was an application under Part III of the Regulation of Investigatory Powers Act (RIPA). He said that the NCA’s application to court was an attempt to circumvent that legislation, which contains important safeguards around obtaining information. Such safeguards include a reasonable belief that requiring disclosure is necessary and a proportionate measure.

Love argued that avoiding the RIPA procedure would breach his rights to enjoyment of property (under Article 1 Protocol 1 of the European Convention on Human Rights) and to respect for private life (under Article 8 of the European Convention on Human Rights). These rights take effect in UK law through the Human Rights Act.

What did the court decide?

4252587897_f1fec9c00b_b

District Judge Nina Tempia refused to grant the NCA’s application. The court would not order Love to disclose the computer passwords to the NCA because “in order to obtain the information sought the correct procedure to be used, as the NCA did 2 ½ years ago, is under… RIPA, with the inherent Human Rights Act safeguards incorporated”. The court’s powers were not to be used to “circumvent specific legislation that has been passed in order to deal with the disclosure sought”. In other words, the NCA couldn’t use an application to the court to get around the human rights safeguards that are built into the UK’s investigatory powers legislation.

Read the Magistrates’ Court judgment here.

Learn more about the right to private life and to peaceful enjoyment of property by clicking the links in this paragraph. Read our recent post on data privacy and the possible threat from ‘Big Data’ here.

Featured image © dfactory, used under Creative Commons Attribution 2.0 Generic Licence. First image © Andrew Turner, used under Creative CommonsAttribution 2.0 Generic Licence. Second image © Ian Sane, used under Creative Commons Attribution 2.0 Generic Licence.

About The Author

Natasha Holcroft-Emmess Associate Editor

Natasha studied BA Jurisprudence and the BCL at Oxford University. She qualified as a solicitor at a London law firm before returning to Oxford to undertake an MPhil, researching international human rights law.

Natasha studied BA Jurisprudence and the BCL at Oxford University. She qualified as a solicitor at a London law firm before returning to Oxford to undertake an MPhil, researching international human rights law.