Back in March, we wrote about the troubling situation in the UK, in which the UK's National Crime Agency (NCA) was trying to force hacker/activist Lauri Love to decrypt his computers, despite never actually charging him with a crime. Back in 2014, US authorities sought to extradite Love for supposedly hacking into government computers. As part of that process, the government took all of his electronics and demanded he turn over his encryption keys. He refused. Under the RIPA (Regulation of Investigatory Powers Act) law in the UK, prosecutors could then charge him for failing to disclose his passwords... but, importantly, they did not do so.

Last year, the NCA actually returned most of Love's stuff, but held onto six items: three computers, two hard drives and an SD card. Love sought to get them back, using a civil legal action against the NCA. The NCA then, somewhat ridiculously, sought to use that civil action to again force Love to decrypt the devices it held, in particular asking that he decrypt some TrueCrypt files on the SD card and hard drives. Thankfully, the court has flatly rejected the NCA's demand, noting that it appeared to be a clear attempt to do an endrun around RIPA, which has a variety of protections.

After reading the papers and hearing from the parties, I am not granting the application because in order to obtain the information sought the correct procedure to be used, as the NCA did 2 ½ years ago, is under section 49 RIPA, with the inherent HRA safeguards incorporated therein. Case management rules are necessary to fulfil their objectives which include the early identification of the real issues in the case and, as per the new CPR relating to applications under the PPA, the applicant to explain his interest in the property. The NCA submits this “lends some support to its submission that Mr Love should in this case be required to provide the encryption key or password as only thus will the court be able to adjudicate fairly upon the complete contents of the devices” (paragraph 3 of supplementary skeleton argument dated 5th April 2016). I am not persuaded by this argument. The case management powers of the court are not to be used to circumvent specific legislation that has been passed in order to deal with the disclosure sought.

The court does note that the issue is not completely closed. But it appears that while Love will not have to disclose his key, that may be used against him in trying to regain control over his stuff:

Finally, I would also add that this court has already directed Mr Love to give particulars of the contents of his files as part of the evidence as to ownership in a witness statement. The NCA accepts the case can be heard in July and they will invite the court to draw interferences

Still, on the whole, not forcing him to disclose under these conditions is nice to see.

British hacker Lauri Love stands accused of causing "millions of dollars" in damages to US government computers -- charges he's been facing for more than two years. These charges originate in the US, but it's the UK that's been trying to get Love to give up his encryption keys for the past couple of years.

Under RIPA (Regulation of Investigatory Powers Act of 2000), the UK government can charge Love with "failure to cooperate" by refusing to comply with the order to decrypt files. To date it has not done so, despite Love blowing off its demands since the middle of February 2014.

The only charges Love is facing have been levied by the US Department of Justice. He has fought extradition for the past couple of years and the UK government has yet to make any progress on that front. However, UK law enforcement has stepped up its efforts to force Love to turn over passwords and keys. J.M. Porup at Ars Technica has seen a copy of the request and has more details.

In the NCA's submission to the court, which Ars has seen a copy of, the government demanded that Love turn over the passwords and encryption keys to his confiscated devices. The devices in question include a Samsung laptop, a Fujitsu Siemens laptop, a Compaq computer tower, an SD card, and a Western Digital hard drive. The NCA in particular wants Love to decrypt TrueCrypt files on the SD card and external drive.

This seems like a very severe demand from the National Crime Authority, considering it still hasn't -- despite two years and two arrests -- seen fit to bring criminal charges against Love. This is also its second attempt -- one using a separate legal authority (not RIPA Section 49, as was used earlier) -- to compel Love to comply with its demands.

Meanwhile, Love is (logically) suing the UK government for the return of his devices.

Love's argument in his civil case is that if the police aren't going to charge him with a crime, they should return his property. "The problem is that the NCA are effectively arguing that any information that cannot be read and comprehended by the police has a presumption of guilt," Love told Ars in an e-mailed statement.

As Love points out, equating encryption with guilt has severe ramifications for anyone who uses it.

"This has clear and troubling implications for groups that handle sensitive communications or other data—journalists, advocates, activists and whistleblowers, and members of the legal profession.

"An executive body of the state is saying that any information to which they are not privy... cannot be owned and kept securely but instead confiscated and access denied," Love added. "This is a fundamental reversal of rights and the potential for abuse is alarming."

The NCA claims it wants Love to decrypt his devices so he can prove his ownership of any information or data found on them -- which allegedly includes pirated film and documents obtained (without permission) for US government websites. Love sees this as nothing more than the NCA trying to help out its American counterparts by using the UK's more permissive laws to obtain information about Love's hacking activities. And, it must be pointed out again -- the NCA wants to force the uncharged Love to crack open his devices so it can find something to charge him with.

Maybe there's something incriminating stored on Love's computers. Maybe not. But either way, UK law enforcement is working backwards from a presumption of guilt. And it's basing this all on things it can't see. This belief system is similar to that held by many law enforcement agencies, which have spent much of the last few months claiming an encrypted phone is a "guilty" phone in front of judges, Congress and to members of the media.

Well, now we know what the UK's anti-terrorism law does best. The Regulation of Investigatory Powers Act (RIPA) expanded powers for security/law enforcement agencies. For safety. For the nation. And, ironically, for the prevention the sort of thing it was recently amended to prevent. While it may occasionally be used to track down terrorists, it seems to be more often deployed by the watchers to watch those watching the watchers.

So far, multiple stories have emerged showing the law has been used to snoop on whistleblowers and journalists -- two entities consistently voted Least Likely to Participate in a Terrorist Attack. Critics said the law would be abused. It didn't take long to prove them right.

Yet another story of twisting RIPA to serve the state's own self-interest has emerged. William Turvill of the UK's Press Gazette has more details.

A BBC journalist suspects that Police Scotland snooped on him without judicial approval to try and find his sources while he was investigating the force.

Eamon O'Connor has claimed that a "very dependable source" believes he was targeted by the force's Counter Corruption Unit.

The revelation comes after the Sunday Herald quoted an inside source as saying that Police Scotland was one of two forces to have accessed phone records, under the Regulation of Investigatory Powers Act (RIPA), to find journalistic sources without judicial approval since the law was changed in March to prevent this.

And now an investigation unit is investigating the investigators. Police Scotland refuses to confirm or deny any of its people are under investigation by the Interception of Communications Commissioner's Office (IOCCO), but the oversight agency has confirmed that is in the middle of an investigation into these allegations.

O'Connor can't say for sure why he was targeted by the police but figures it has something to with his investigations into an unsolved killing that saw millions of pounds spent but no significant arrests or charges brought.

Police Scotland mounted a massive operation to catch Emma's killers. They spent £4m of the taxpayers' money and ended up charging four Turkish men with her murder. But the man was released and no trial took place.

"I made a Radio 4 documentary for File on Four earlier this year which highlighted a number of very serious problems with the way in which the original investigation was run. I can only assume that that has caused some concern inside Police Scotland.

This lack of details also makes it unclear whether the new RIPA stipulations have actually been abused or whether the police performed this surveillance under the old form. Presumably, this will all be sorted out by the IOCCO investigation. And, presumably, most of what it uncovers will be withheld from the public -- pretty much a given when alleged abuse of powers has a nexus with anti-terrorism laws.

O'Connor notes that he's not personally afraid of the police paying him extra attention in return for the "extra" attention he's paid to their actions. But he notes that this sort of thing can easily chill future examinations of police misconduct/failures.

"I'm not frightened for my personal safety or anything of that kind. But I do feel that this is likely to intimidate and impede whistleblowers and people who want to come forward to tell the truth about something they believe shouldn't have happened…

"If I'm intimidated or impeded from doing that, and my sources are intimidated and impeded from doing that because they fear they are being monitored, then proper journalism can't be done."

If so, then it would appear the unlawful snooping has done exactly what Police Scotland hoped it would: chill further examination of its incompetence.

Last month, we wrote about how the UK police used powers brought in to tackle terrorism and serious crime to snoop on a journalist's phone records in order to reveal his source. Last week, we learned that this was not a one-off: journalists at the UK's Mail on Sunday newspaper were also spied on using the same anti-terrorism law:

Police used anti-terrorism powers to secretly spy on The Mail on Sunday after shamed Cabinet Minister Chris Huhne falsely accused journalists of conspiring to bring him down.

Detectives sidestepped a judge’s agreement to protect the source for our stories exposing how Huhne illegally conspired to have his speeding points put on to his wife's licence. Instead they used far-reaching powers under the controversial Regulation of Investigatory Powers Act (RIPA) -- originally intended to safeguard national security -- to hack MoS phone records and identify the source.

They trawled through thousands of confidential numbers called by journalists from a landline at the busy newsdesk going back an entire year, covering hundreds of stories unrelated to the Huhne case.

These two cases have finally set the alarm bells ringing in the UK. The newspaper affected in the first case has written to the Investigatory Powers Tribunal about the incident:

The Sun has made an official complaint about the Metropolitan police's use of anti-terror laws to snoop on its political editor's phone calls.

It has written to the Investigatory Powers Tribunal to seek a public review of the Met’s use of the Regulation of Investigatory Powers Act to obtain Tom Newton Dunn's phone records.

That's unlikely to have much effect, but a move by Keith Vaz, chair of the powerful home affairs select committee in the UK Parliament, may do:

Every police force in the UK is to be asked by a parliamentary committee to reveal how many times they have secretly snooped on journalists by obtaining their telephone and email records without their consent.

Keith Vaz, chairman of the home affairs select committee, said he wanted a detailed breakdown of police use of the Regulation of Investigatory Powers Act (Ripa) to force telecoms companies to hand over phone records without customers' knowledge.

Indeed, things have become so serious that even the Interception of Communications Commissioner, who oversees this area, is launching his own inquiry (pdf) - but not a public one, which is what The Sun newspaper has requested:

Today I have written to all Chief Constables and directed them under Section 58(1) of RIPA to provide me with full details of all investigations that have used Part I Chapter 2 RIPA powers to acquire communications data to identify journalistic sources. My office will undertake a full inquiry into these matters and report our findings to the Prime Minister and publically so as to develop clarity in relation to the scope and compliance of this activity.

This double-pronged attack should force the UK's top police officers to own up to what they have been doing secretly with RIPA. If it turns out that its powers have been routinely abused, the pressure for reforming the outdated RIPA will be greatly increased. Already, the Liberal Democrats, the junior partner in the UK's coalition government, have called for changes to RIPA that would protect journalists and whistleblowers from state snooping, while Keith Vaz wishes to go even further, as the Guardian reports:

Vaz said Ripa was not fit for purpose and needed "total refurbishment". He said: "It is important that the public and parliamentarians get statistics on the number of times it is being used and how it is being used without journalists having to submit freedom of information requests. All kinds of mistake are being made. Anecdotally we've heard of local authorities using it to check people's addresses when parents make applications for schools."

It's rather rich that at precisely the moment we find out how the UK police have been abusing RIPA's anti-terrorism surveillance capabilities to investigate minor offenses, the head of the UK's National Crime Agency has the gall to ask for even more powers.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

So we recently wrote about how the Metropolitan Police in the UK abused an anti-terror law, the Regulation of Investigatory Powers Act (RIPA), to dig into a journalist's phone records without any judicial oversight as the police sought to minimize a scandal relating to an incident (Plebgate) involving the police. That led many to wonder just how often the police abuse that law to get records from journalists with no oversight. The answer appears to be "screw you, we're not saying." Or the equivalent of that with a friendly British accent:

Asked how many times they have used Ripa to seize telephone or email records belonging to journalists, Scotland Yard said: “We are not prepared to discuss.”

The line between "not prepared" and "oh fuck, we don't have to reveal that, do we?" appears to be fairly blurry.

Plebgate is one of those silly minor political spats in the UK involving a top UK politician who apparently got angry that police wouldn't let him ride his bike out of the main gate at 10 Downing Street. The details really don't matter. It's just one of those political type stories that the press loves. But, now it's come out that in investigating this incident, the Metropolitan Police appear to have abused an anti-terror law to obtain the phone records of journalists who reported on the story.

Specifically, the police made use of the Regulation of Investigatory Powers Act (RIPA), the big anti-terror law in the UK that earlier this year we noted was abused to track down a government whistleblower. And this time it was used to get the phone records of Tom Newton Dunn, the political editor of The Sun, because the Sun reported on the whole Plebgate affair. The use of RIPA -- which, again, is supposed to be for tracking down terrorists -- let the police circumvent the law they're supposed to use, the Police and Criminal Evidence Act (PACE), which requires the police to actually go before a judge first when trying to access journalistic materials. With RIPA, the police could just claim they need the records, and boom, the phone company handed them over.

For various obvious reasons, journalists are fairly alarmed by this clear abuse of the law to view the private communications of journalists. From the Guardian's coverage of this:

Sources in the Sun newsroom said Newton Dunn was disgusted and outraged to learn the police had seized his phone records. “The first we knew of it was yesterday, we are taking legal advice,” said the source on Tuesday. “We would never have known unless the Met report came out.”

Another said: “This is unbelievable. It’s like the secret police going round checking journalists’ phones. If they have done this, the bigger question is how often have they done this?”

Actually, the bigger question goes beyond just how often have they done this for journalists' records, but how often are they doing this for lots of other stuff. As David Meyer at GigaOm rightly points out, the recent (rushed through with no debate) data retention law, DRIP, in the UK expands RIPA to cover all kinds of internet communications as well. Thus, thanks to DRIP, the police can get all sorts of similar information -- and they seem clearly willing to use it on cases that have absolutely nothing to do with terrorism at all, but even in minor political spats that involve the police themselves.

It's not a surprise that surveillance laws will be abused. But it's worth highlighting when they're abused so egregiously.

The UK government continues to claim that its spying activities are lawful, without specifying exactly why. However, it's pretty clear that the main law it is depending on is the Regulation of Investigatory Powers Act 2000 (RIPA). As Techdirt reported in January, there are serious doubts about whether GCHQ's surveillance activities are indeed covered by RIPA, but that's not the only problem here: the following story from The Guardian shows how RIPA is being abused -- not to find terrorists trying to bring down the state, but to winkle out whistleblowers selflessly trying to help it:

MPs have criticised Britain's leading tax official after HM Revenue & Customs [HMRC -- the UK tax authority] used powers meant to catch terrorists to hunt down an employee who exposed a secret multimillion-pound "sweetheart" deal with Goldman Sachs.

Lin Homer, the chief executive of HMRC, had told the public accounts committee that phone records had been obtained using the Regulation of Investigatory Powers Act (Ripa) to unearth information about Osita Mba, an in-house lawyer.

In 2011, Mba had written in confidence to various government bodies, saying that the then head of UK tax, Dave Hartnett, had "let off" Goldman Sachs from paying at least £10m in interest. But instead of being grateful for this information, the tax authorities seemed more interested in hounding him:

When HMRC discovered Mba's intervention, his belongings, emails, internet search records and phone calls and the phone records of his then wife, Claudia, were examined by investigators.

At the committee meeting, Hodge also asked whether it was appropriate to pass Mba's wife's address, mobile number and office number to HMRC staff to investigate.

HMRC's abuse of RIPA extended to investigating Mba's communications with a Guardian journalist:

Margaret Hodge, the chair of the [Parliamentary] committee, said that HMRC's use of the powers, ostensibly to track down whether Mba had been talking to the Guardian's then investigations editor, David Leigh, had "shocked her to her bones".

Hodge went on to ask for assurances that HMRC would never again use RIPA powers on a whistleblower:

[Tax chief] Homer declined to offer Hodge the desired reassurance, responding: "You know that we cannot offer carte blanche assurances for evermore that we won't use these -- I have other duties of care to parliament and other individuals."

That refusal underlines why the UK's RIPA needs serious revision -- both to stop this kind of abuse, and to bring some much-needed scrutiny to the legal basis for GCHQ's massive surveillance activities.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+