Stanford, R. v [2006] EWCA Crim 258

Case No 2005/05323/B4

[2006] EWCA Crim 258

IN THE COURT OF APPEAL

CRIMINAL DIVISION

Venue Royal Courts of Justice

Date Wednesday, 1 February 2006

The Strand

London

WC2A 2LL

B e f o r e:

THE LORD CHIEF JUSTICE OF ENGLAND AND WALES

(Lord Phillips of Worth Matravers)

MR JUSTICE CRESSWELL

MR JUSTICE OPENSHAW

Between

R E G I N ACrown

- v -

Between

CLIFFORD STANFORD

Computer Aided Transcription by

Smith Bernal, 190 Fleet Street, London EC4

Telephone 020-7421 4040

(Official Shorthand Writers to the Court)

MR T OWEN QC and MR A BAILIN appeared for APPLICANT

MISS S WHITEHOUSE appeared for CROWN

J U D G M E N T

Wednesday, 1 February 2006

[1]On 14 September 2005, in the Crown Court at Southwark, before His Honour Judge Rivlin QC, the applicant pleaded guilty to the unlawful and unauthorised interception of electronic mail communications to a public company, contrary to section 1(2) of the Regulation of Investigatory Powers Act 2000 ("the Act"). This was, we believe, the first prosecution under that section. On 15 September Judge Rivlin sentenced the applicant to six months' imprisonment, suspended for two years; he was also fined £20,000 and ordered to pay prosecutions costs in the sum of £7,000. He was acquitted of a second count of conspiracy to blackmail after the prosecution offered no evidence. His applications for leave to appeal against both conviction and sentence were referred to this court by the Registrar.

[2]A co-defendant, George Lidell, pleaded guilty to the same offence and was sentenced to six months' imprisonment, suspended for two years.

[3]The applicant pleaded guilty following a ruling by the judge on the construction of section 1(2) of the Act. The ruling was relevant to a version of the facts that the applicant intended to advance by way of defence but that was in conflict with facts advanced by the prosecution. The effect of the ruling was that the facts that the applicant intended to advance would not amount to a defence in law. The applicant then entered a plea of guilty. The sentence was imposed on the basis of a statement of facts agreed between the prosecution and defence for the purpose of sentence.

Conviction

[4]Section 1 of the Act provides:

"(1) It shall be an offence for a person intentionally and without lawful authority to intercept, at any place in the United Kingdom, any communication in the course of its transmission by means of -- (a) a public postal service; or (b) a public telecommunication system. (2) It shall be an offence for a person -- (a) intentionally and without lawful authority, and (b) otherwise than in circumstances in which his conduct is excluded by subsection (6) from criminal liability under this section, to intercept, at any place in the United Kingdom, a communication in the course of its transmission by means of a private telecommunication system. (3) Any interception of a communication which is carried out at any place in the United Kingdom by, or with the express or implied consent of, a person having the right to control the operation or the use of a private telecommunication system shall be actionable at the suit or instance of the sender or recipient, or intended recipient, of the communication if it is without lawful authority and is either -- (a) an interception of that communication in the course of its transmission by means of that private system; or (b) an interception of that communication in the course of its transmission, by means of a public telecommunication system, to or from apparatus comprised in that private telecommunication system. .... (5) Conduct has lawful authority for the purposes of this section if, and only if -- (a) it is authorised by or under section 3 or 4; (b) it takes place in accordance with a warrant under section 5 ('an interception warrant'); or (c) it is in exercise, in relation to any stored communication, of any statutory power that is exercised (apart from this section) for the purpose of obtaining information or of taking possession of any document or other property. (6) The circumstances in which a person makes an interception of a communication in the course of its transmission by means of a private telecommunication system are such that his conduct is excluded from criminal liability under subsection (2) if -- (a) he is a person with a right to control the operation or the use of the system; or (b) he has the express or implied consent of such a person to make the interception."

The facts as alleged by the prosecution

[5]The prosecution's case on the facts was as follows. The applicant was the deputy chairman of Redbus. The chairman of the company was John Porter. He is the son of the former leader of Westminster Council, Dame Shirley Porter.

[6]In 2002 the applicant and John Porter fell out. The applicant resigned from the Board on 20 June 2002. He retained a 30% shareholding in the company. The applicant was determined to regain his position and he began plotting with Mr Lidell. His aim appears to have been to collect as much information as he could to discredit John Porter, thus forcing his resignation.

[7]During the time that the applicant was on the Board of Redbus, the company's e-mail server was kept and managed by him at his own premises in Margaret Street, London W1. E-mails sent to any member of staff at Redbus had to travel via the server in Margaret Street. All staff e-mail accounts were held on that server. The server was run using software called Communigate. This software allows an e-mail system to function, enabling the transmission and receipt of communications. Users can store e-mails, delete them, reply to them and copy them to others. In addition, it is possible for a user of the system to set up what is known as a "rule" on an e-mail account so that any e-mails sent to that account are automatically copied to another e-mail address. This process is called "mirroring". The e-mails are copied to the other address simultaneously, as soon as the e-mail enters the server. Any user can set up a mirroring rule on his own e-mail account, as can a person with the status of an administrator.

[8]On 20 June 2002, following the applicant's resignation, new arrangements had to be made for the Redbus system. To this end, the user data and e-mails on the server at Margaret Street were all copied to an e-mail server at new premises in Sovereign House, Marsh Wall, London E14. The domain name was modified so that any e-mails sent to Redbus would be sent to Sovereign House, not Margaret Street. The usernames and passwords were not changed. The applicant had had administrator status for the e-mail server when he was a director of Redbus. He no longer enjoyed this status following his resignation. However, he was able to log on to the system by using the name and password of another administrator because these details had remained unchanged following the transfer. The applicant was familiar with the system and the passwords used. The interception of e-mails which took place in this case was achieved by the setting up of mirroring rules on John Porter's e-mail system, and others. The applicant was responsible for the mirrors.

The facts as alleged by the defence

[9]Most of the facts alleged by the prosecution were common ground. The difference between the prosecution and the defence related to the manner in which the interception was arranged. The facts as alleged by the defence were set out in the judge's ruling as follows:

"(a) X exists. (b) At the material time X was an employee of Redbus Interhouse Plc. (c) X was in possession of an administrator username and password. (d) The use of passwords at RBI -- that is Redbus Interhouse -- was lax. This reflected a policy at RBI of 'We trust our employees', which meant that passwords were not generally secret. (e) At least one and probably more of those with administrator access were content for his password to be known and used by many RBI employees. (f) X had been given the administrator username and password by Y. Y was authorised to use an administrator username and password. (g) Y allowed X to use the administrator username and password. (h) No express limit was placed on the tasks which X could perform using the administrator username and password, but X was not explicitly given permission by Y, or anybody else, to put in place the diverts in question. (i) X put in place the diverts in question by using the administrator usernames and password given by Y, in order to gain access to the relevant part of the system. (j) Mr Stanford himself did not put in place the diverts in question by hacking into the system, or otherwise. (k) Mr Stanford gained access to the intercepted e-mails by means of the diverts put in place by X."

[10]That summary of the facts was placed before the judge by those acting for the applicant in what they described as a "factual matrix" for the purpose of obtaining the judge's ruling. In his ruling the judge expressed anxiety about the exercise that he had been asked to perform. He expressed the view that a preliminary ruling should only be given against the background of a clear and unambiguous factual matrix and that the matrix advanced on behalf of the applicant did not answer that description. In particular there was no evidence as to the circumstances in which Y was asked by X for permission to use his administrator username and password, nor as to the purpose for which this permission was required and given.

[11]We endorse the reservations expressed by the judge. The factual matrix advanced on behalf of the applicant was a skeletal and wholly inadequate synopsis of the evidence that the applicant intended to adduce. It was not realistic for the applicant to imagine that he would be able to avoid fleshing out the skeleton with detail, which would include the identities of Y and X and the purpose of the alleged agreement between them as to the use of Y's username and password. When delivering his ruling the judge remarked that it had been necessary in the course of argument for him to be referred to passages in witness statements and an expert's report prepared on behalf of the applicant, though he did not go into further detail.

[12]Despite all of this, the judge was prepared to give a ruling on the interpretation of subsection (6) of section 1 of the Act. We are inclined to think that he would have been wiser to decline to do so. The fact remains, however, that his ruling led to a plea of guilty and, provided that we uphold it, the course that he took will have avoided the need for a trial. The Judge's Ruling

[13]The judge recorded the applicant's submissions as having been advanced in the alternative, the thrust of each alternative being that the conduct of X, who had been induced by the applicant to make the interception, was excluded from criminal liability because either X was a person who had a right to control the operation or use of the system (section 1(6)(a)) or X had the express or implied consent of such a person to make the interception (section 1(6)(b)). If X had no criminal liability, the applicant could have none either. As to the first alternative, it was the applicant's case that because X, through the use of Y's username and password, had been placed in a position to control the use of the system he was "a person with a right to control the operation or use of the system". As to the second alternative, it was the applicant's case that Y was a person with a right to control the operation and use of the system and that X had the express or implied consent of Y to make the interception.

[14]In dealing with the first alternative, the judge cited a lengthy passage from the speech of Lord Hobhouse of Woodborough in R v Bow Street Metropolitan Stipendiary Magistrate and Another, ex parte Government of the United States of America

[2000] 2 AC 216

. The relevant passage dealt with the following sentence from section 17 of the Computer Misuse Act 1990:

"Access of any kind by any person to any programme or data held in a computer is unauthorised if -- (a) he is not himself entitled to control access of the kind in question to the programme or data."

Lord Hobhouse commented:

15. "the word 'control' in this context clearly means authorise and forbid .... it is plain that [the subsection] is not using the word 'control' in a physical sense of the ability to operate or manipulate the computer."

Lord Hobhouse commented:

[15]The judge applied the same reasoning to the word "control" in section 1(6)(a) of the Act. He held that "right to control" meant more than merely "the right to access or to operate the system". It meant the right to authorise or forbid the operation or the use of the system.

[16]As to the second alternative, the judge rejected the submission that if X had a general authorisation to operate or use the system, this embraced authorisation to "make the interception" for the purposes of section 1(6)(b). That subsection would only apply if X had authority to make the specific interceptions which were made.

[17]The plea of guilty that was entered by the applicant recognised that he was not in a position to establish that X fell within either section 1(6)(a) or 1(6)(b), as interpreted by the judge.

The Grounds of Appeal

[18]Mr Tim Owen QC has not pursued the argument that X fell within section 1(6)(b). His submission is that the judge's interpretation of section 1(6)(a) was erroneous. Some of his skeleton argument and grounds of appeal are off target for they are directed to what the controller may do without attracting criminal liability, whereas the issue is what section 1(6)(a) means when it speaks of "control". As to this the applicant's case appeared, only by implication, from the following paragraph in his Grounds of Appeal:

"The effect of the judge's definition was wholly to undermine the legislative intent. His ruling criminalised X even though the username/password s/he had been given gave them the unfettered ability to control the operation and use of the system and also the right to do so since they have been knowingly given it without any restrictions as to its us."

[19]Two propositions are implicit in this submission. The first is that "control" means the unrestricted ability physically to operate and use the system. The second is that Y, by giving X the unrestricted ability physically to operate and use the system without imposing any express restriction on the manner in which he could use that ability, thereby gave X the "right" to use that ability without restriction.

[20]The judge did not rule on the second proposition. It is one which does not arise if "control" means "authorise and forbid". Plainly conferring the unrestricted ability on X to use and operate the system without any express restriction could not give X the right to authorise or forbid others to operate and use the system. We would, however, make the following observations about the second proposition. If Y, an employee of Redbus, gave X, a more junior employee, the use of his password and thus the unrestricted ability to use and operate the system, it does not follow that Y gave X the right to use and operate the system without restriction. "Right" in this context we would construe as "authority". The factual matrix makes it plain that Y was one of a number of employees with "administrator access". Those with such access must have been given it by someone in higher authority. It is unlikely that Y and others with "administrator access" had unrestricted authority to use their ability to operate and use the system in any way they chose. It is even less likely that they were entitled to delegate that authority to a junior employee.

[21]We turn to the first proposition, namely that "control" means the unrestricted ability physically to use and operate the system. We agree with the judge that this interpretation is untenable. We agree with him that "control" means "authorise and forbid". We have two reasons for adopting this interpretation. The first is that it accords with the verbal context in which "control" is set. The second is that it produces a sensible result.

[22]We turn first to the context. What is in issue is "the right to control the operation or use of the system". The meaning of this phrase is wider than "the right to operate or use the system". The concept of "control" in this context extends to controlling how the system is used and operated by others. This fact is underlined by section 6(1)(b) which extends protection to a person who has the express or implied consent to make the interception of the person with the right to control.

[23]Our interpretation also makes sense of the legislative provisions. The objective of section 1 of the Act is not in doubt. It is to protect the privacy of private telecommunications. This is clear from the wording of the section, from its relevant provisions and from its background. That background is as follows.

[24]On 22 April 1992 Ms Alison Halford complained to the European Commission of Human Rights that an interception of calls made from her office and home telephones amounted to an unjustified interference with her rights to respect for her private life, contrary to

Article 8 of the European Convention

on Fundamental Rights and Human Freedoms. The European Court decided that the interceptions were an interference with Ms Halford's right to respect for her private life and correspondence. (See Halford v United Kingdom

(1997) 24 EHRR 523

, paragraph 48.)

[25]The European Court went on to note at paragraph 51 that:

"there is no .... provision in domestic law to regulate interceptions of telephone calls on [private telecommunications systems]. It cannot therefore be said that the interference was "in accordance with the law" for the purposes of Article 8(2) of the Convention, since the domestic law did not provide adequate protection to Ms Halford against interference by the police with her right to respect for her private life and correspondence."

The sections in the Act relating to interceptions of a private telecommunication system were enacted in order to remedy the deficiencies noted by the European court in Halford."

[26]It would undermine the object of section 1 if anyone with unrestricted ability to operate and use a telecommunications system was exempt from criminal liability for intercepting communications. Mr Owen accepted that it might be necessary for a number of employees to have unrestricted access to the system for administrative or technical reasons. On the interpretation of "right to control" for which he contended, all of these would be able to intercept communications destined for others without committing an offence. This would rob the section of much of its effect. Mr Owen also accepted that, on his interpretation, a company that was lax in its use of passwords, so that a large number of employees could gain unrestricted access to the communications system, would thereby permit them to intercept communications designed for others without criminal sanction. "Immunity extends to one or to one hundred people, depending on how many have unrestricted access to the system" was the way that he put it. He further accepted that the latter scenario would defeat the object of the section. He submitted that it was for employers to ensure that they had a tight system of control so that this result would not follow. This result would not, however, follow if the judge's narrower interpretation of "right to control" is adopted. Mr Owen submitted that the civil remedy available under section 1(3) would suffice to protect privacy rights in such circumstances. We do not agree. The scheme of the legislation is that criminal sanctions should provide the primary protection against the interception of private communications.

[27]There can be good reasons why a person who has the right to direct how the system should be used, and thus to authorise and forbid particular operations, should be permitted to intercept communications. Such a person will necessarily have managerial status. The Consultation Paper that preceded the legislation in question gave some examples of this:

"There are a number of legitimate reasons why non-public networks operators might wish to monitor or record communications passing over their network. Some, particularly within the financial sector, use recording as a tool to provide evidence of transactions. Some operators offering telesales services monitor their staff when they are dealing with customers by telephone for training and development or quality control purposes. And some employers need to monitor communications for internal security or the prevention of fraud. There is a need to take account of this requirement in new legislation, yet also to protect the rights of the employee against interception where they have a legitimate expectation of privacy."

[28]Section 1(6)(b) makes provision for the grant of express authority to make intercepts in order to cater for such needs. What if that authority were given to an employee by a managing director who did not himself operate the communications system, or have a password enabling him to do so? On Mr Owen's interpretation he would not be a person with a right to control the operation or use of the system under section 1(6)(a), with the result that the employee could not rely upon his consent as a defence to a criminal charge. Such a result would be bizarre.

[29]For all these reasons, the interpretation reached by the judge makes sense of the legislation. That advanced on behalf of the applicant does not. Indeed, if the applicant had a defence in law on the facts of this case it would demonstrate that the legislation had failed to achieve its object.

[30]For these reasons we have concluded that the judge's ruling was plainly correct and we refuse leave to appeal against it.

Sentence

[31]The agreed basis of the applicant's plea of guilty, dated 14 September 2005, was as follows:

"At the material time: a. X, an employee of Redbus Interhouse plc, was responsible for the interceptions in question. b. X was in possession of an administrator username and password. c. X had been given the administrator username and password by Y. Y was authorised to use an administrator username and password. d. Y allowed X to use the administrator username and password. e. No express limit was placed on the tasks which X could perform using the administrator username and password but X was not explicitly given permission by Y (or anyone else) to put in place the diverts in question. f. X put in place the diverts in question by using the administrator username and password given by Y in order to gain access to the relevant part of the system. g. The [applicant] himself did not put in place the diverts in question by hacking into the system or otherwise. h. The [applicant] obtained the intercepted e-mails as a result of the diverts put in place by X. i. The [applicant's] purpose in obtaining the intercepted e-mails in question was to obtain corroborative evidence of his belief that there existed an undisclosed concert party relating to Redbus Interhouse plc between John Porter and others which the [applicant] believed was illegal and/or in breach of the Takeover Panel rules. j. In February 2003, when preparing an application to the Panel on Takeovers and Mergers in relation to the activities of John Porter, the [applicant] sought legal advice about the legality of obtaining e-mails via X in this way. He was not advised that this was illegal."

In his sentencing remarks the judge made the following comments about this basis of plea: 33. "The Crown's case, about which there has been understandable silence in your basis of plea, is that you, Mr Stanford, arranged to intercept e-mails with the hope that, by gaining knowledge of the conduct of John and Shirley Porter that might be disadvantageous to them, you could use that information to further your ambitions in relation to Redbus. 34. .... 35. .... I take into account the basis of your plea, which is helpfully set out in a document, and which learned counsel for the Crown says, to use a well-worn expression, the Crown is unable to gainsay. I have read this with care and I make it clear that I am prepared to accept this basis of plea and act on it accordingly, but, having said that, in this connection there are three important matters to be noted: first, it is not your case, and, in any event, if it were I would not accept that the person you name as X was a person in a position to control the operation or the use of the equipment, in the sense of that phrase upon which I ruled yesterday. Second, nor is it contended, and nor would I accept without evidence, that Y, whoever he or she is, either knew, or would have given consent to the use of the password for the purpose to which it was actually put. Third, although there has been some mention of taking legal advice after these events, and I have seen the papers in respect of that, I have no doubt that if the lawyers had known anything of the kind of e-mail conversation which took place in September, 2002, to which I have referred, you would have received very strong advice about your intentions. 36. I am afraid that I cannot accept the submission made on your behalf that your conduct was on the borderline between criminal and civil liability. This was not behaviour in some sort of grey area, but, in my view, plainly criminal. Moreover, whatever the outcome of your later going with this material to the press, both of you know that, at the time when you actually committed this offence, it was not then your intention to affect the outcome of any proceedings between the Westminster Council and Dame Shirley Porter, but, in effect, it was your intention, Mr Stanford, to take over this company."

[32]Mr Owen submitted that it was implicit in these remarks that the judge was influenced in deciding on the appropriate sentence by what he saw as the possibility that the applicant would use the material obtained by the intercepts for the purpose of blackmail.

In his sentencing remarks the judge made the following comments about this basis of plea:

[33]The critical paragraph in the basis of plea is (i) which reads:

"The [applicant's] purpose in obtaining the intercepted e-mails in question was to obtain corroborative evidence of his belief that there existed an undisclosed concert party relating to Redbus Interhouse plc between John Porter and others which the [applicant] believed was illegal and/or in breach of the Takeover Panel rules."

What this paragraph does not state is the use that the applicant intended to make of this evidence. It is, however, common ground that the applicant wanted to use this evidence to gain control of Redbus. The judge's reference to the e-mail conversation which took place in September 2002 suggests that he may have attached weight to the possibility that the intercepted material might have been used for blackmail. We are not, however, persuaded that he did so. He found, and was entitled to find, that the applicant's objective was not to place the intercepted material before the appropriate authorities. The judge further found, and rightly found, that the applicant's objective in obtaining the intercepted material was to oust the Chairman of a company and wrest control of that company for himself. High financial stakes were involved.

[34]Mr Owen repeated to us submissions made to the judge that the applicant's behaviour was on the cusp of what was criminal. The judge did not agree; nor do we. The crime that section 1 of the Act proscribes is the obtaining of private information by intercepting it in the course of electronic transmission. We are in no doubt that when the applicant and his co-defendant planned the interceptions in question they were well aware that they were doing something improper and, on the premise that they obtained the intercepts through X, that they were inducing him to act with impropriety and in beach of his duty to his employers. This was not a case of an inadvertent over-stepping of the mark.

[35]The maximum penalty for the applicant's offence is a sentence of two years' imprisonment, which can be combined with a fine. We think that material factors when weighing the seriousness of an offence under section 1 must be the nature of the material obtained by the interception and the object of obtaining it. There is an obvious quantum leap between intercepting a personal message which has no financial implications, and intercepting confidential material of financial significance with the object of using it for commercial gain or to cause others commercial damage. We consider that the judge was right to send a strong message that such conduct constitutes serious wrongdoing. We are in no doubt that, on the facts of this case, the custody threshold was passed and that six months' imprisonment was an appropriate sentence. At the same time, we think that the judge was right to recognise the applicant's good character and his plea of guilty by suspending that sentence. There was nothing wrong in principle, having regard to the fact that this was conduct that was aimed at procuring for the applicant a substantial commercial advantage, in combining this sentence with a substantial fine.

[36]For these reasons we have decided to refuse leave to appeal against sentence.

[37]MR OWEN: My Lord, would you hear me on the refusal of leave to appeal against conviction? My Lord, I am bound to say I was slightly taken aback by that because in circumstances where a case is referred to the full court by the Registrar, and then a period of time is set aside which, on the face of it, indicates acceptance of a substantial issue, and bearing in mind it is the first occasion on which this statute has been considered, the effect of a refusal to grant leave, as opposed to granting leave and then dismissing the appeal, is that I cannot even address you on certification for the purposes of an appeal to the House of Lords. I think that both my learned friend and I had assumed that the court would grant leave, albeit the fact that my learned friend was not called on meant that you would dismiss the appeal. I would, therefore, want to address you on certification --

THE LORD CHIEF JUSTICE: If it were open to you to do so.

[39]MR OWEN: Yes, but I cannot do so if you were to maintain that refusal. I am sorry, I perhaps should have sought clarification of it, but I am afraid I just assumed that leave would be granted.

THE LORD CHIEF JUSTICE: Yes, I see. Let us hear what Miss Whitehouse has to say?

[41]MISS WHITEHOUSE: My Lord, I am not sure that I can add anything to what my learned friend has said. I made no assumptions as to what your Lordships' ruling would have to say on the topic. The fact that time was set aside does not necessarily mean that leave to appeal would be granted. Whether it should be granted or not is a matter on which I am neutral. It is a matter for your Lordships.

THE LORD CHIEF JUSTICE: Mr Owen, we feel that this is an open and shut case. We have an obligation, do we not, to consider whether there should be an order for costs?

[43]MR OWEN: My Lord, may I make submissions now on that? The position is that it was referred immediately by the Registrar. In effect we are here for that reason.

THE LORD CHIEF JUSTICE: Yes, so you are. No application has been made. We are always reminded that we have a positive duty to consider costs when we are hearing an appeal, but, as we have refused leave, this is not such a case. ___________________________________