The Regulation of Investigatory Powers (RIP) Bill, which grants the UK government sweeping powers to access email and other encrypted Internet communications, was passed in a final vote by the House of Commons on Wednesday and becomes law on October 5.
A provision in the Bill requires ISPs (Internet service providers) in the UK to track all data traffic passing through their computers and route it to the Government Technical Assistance Centre (GTAC). The GTAC is being established in the London headquarters of MI5.
The House of Commons, which passed the RIP Bill earlier this year, voted to approve amendments added by the House of Lords on July 13. The bill now needs to go through the formal Royal Assent.
Cosmetic ISPs and civil-rights organizations have argued that the amendments are mainly cosmetic and do not adequately address the "Big Brother" powers granted to the government to access email and other electronic data without a warrant.
The Bill means the UK government - specifically the Home Office and Home Secretary Jack Straw - can demand encryption keys to any and all data communications, with a prison sentence of two years for those who do not comply with the order.
Another part of the Bill says that when a company official is asked to surrender an encryption key to the government, that individual is barred by law from telling anyone - including their employer, be it senior management or security staff - that they have done so. Guidelines for this "tipping-off" offence, as it is known, could leave an international company completely unaware that what it assumes is secure company data may be under investigation by MI5. Those violating the tipping-off offence can face up to five years in prison.
UK protection While UK employees are protected against the consequences of passing encryption keys or encrypted data to the government, that protection does not extend outside the UK to other jurisdictions, such as that of the parent company.
Civil-liberties organizations are concerned that the government's email interception Bill would grossly encroach on privacy, while businesses fear the law will force companies to move operations to other countries, such as Ireland, that do not have such restrictions. UK ISPs are concerned that the cost of establishing the technology required by the Bill will be crippling. Some ISPs, including PSINet, have said they will be forced by the Bill to move their operations out of the UK altogether.
On June 16, the House of Lords received an open letter signed by 50 organizations, asking that the Bill be further amended or just plain scrapped. The letter claimed: " We are deeply concerned that the Bill will inhibit the development of the Internet and e-commerce." It’s signed by Consumers International and Amnesty International, among others.
Hard copy The amendments added by the House of Lords - while not changing any of the major provisions in the RIP law - give the government the discretion to allow companies to turn over printed text rather than encryption keys. Furthermore, as with telephone wire taps, the Home Secretary must now personally approve in writing all interception warrants as well as financial compensation for ISPs required to install monitoring equipment.
During Wednesday's debate in the House of Commons, Home Office minister Charles Clarke argued that the RIP bill will not harm UK e-commerce and that the law suffers primarily from a perception problem, caused mainly by alarmist reports in the media.
Clarke said: "Given the comments made in the overseas media, we must explain clearly what the Bill is and is not, and why we do not believe it poses a threat to e-commerce in Britain; on the contrary, it will help to achieve the government's aim of a strong and secure e-commerce economy, to which we are all committed."
Re-education Clarke stressed that "propaganda is needed" to re-educate the public about the provisions of the Bill and asked the House of Commoms for help in promoting "the interests of this country's businesses when the time comes".
The BBC has estimated that implementing the RIP Bill will cost companies £46 billion over five years, a claim that Jack Straw vehemently denied in a letter sent to the Financial Times on June 14 and posted on the Home Office Web site.