Greater Manchester Police v Andrews [2011] EWHC 1966 (Admin)

Case No CO/1658/2011[2011] EWHC 1966 (Admin)
IN THE HIGH COURT OF JUSTICE
QUEEN’S BENCH DIVISION
ADMINISTRATIVE COURT
Sitting at:
Venue Manchester Civil Justice Centre
1 Bridge Street West
Venue ManchesterDate Monday 23 rd May 2011
M3 3FX
Before
PRESIDENT OF THE QUEEN'S BENCH DIVISION(SIR ANTHONY MAY)MR JUSTICE MCCOMBE
Between
Greater Manchester PoliceAppellantAndrewsRespondent
(DAR Transcript ofWordWave International LimitedA Merrill Communications Company1965 Fleet Street, London EC4A 2DYTel No: 020 7404 1400 Fax No: 020 7404 1424Official Shorthand Writers to the Court)
Mr Hamilton appeared for Appellant.Mr Maguire appeared for Respondent.
Judgment
[1]This is an appeal by way of case stated in the decision of HHJ Steiger QC sitting in the Crown Court in Manchester on 18 November 2010 whereby the judge refused an application by the appellant, the Chief Constable of the Greater Manchester Police. The application was for an order granted to the Chief Constable for permission to serve upon the respondent, Anthony Andrews, a notice under Section 49 of the Regulation of Investigatory Powers Act 2000 (which I will call either “the Act” or “RIPA”). Such a notice was to require Mr Andrews to disclose “protected information”, the expression defined in Section 56 of the Act in the following terms:
"Any electronic data which without the key to the data a) cannot or cannot readily be accessed or b) cannot or cannot readily be put into an intelligible form… "
[2]The circumstances in which the application came to be made are these. The respondent is now aged 49. On 10 July 1998 he was convicted of 23 sexual offences committed between 1992 and 1998. Suffice it to say that those offences were committed on two young girls and one young boy and were extremely serious in nature. Following his conviction the respondent was made the subject of a Sexual Offences Prevention Order. He was released from prison at some stage in 2009/2010 as to which the precise date has not been identified. However, on 14 June 2010 he was arrested on suspicion of breaching the Sexual Offences Prevention Order, when a member of the staff at the hostel where he was residing found him looking at photographs of children.[3]The respondent's laptop computer was seized together with two pen drives or memory sticks. These were submitted for forensic examination as the examination of the computer has revealed indecent images of children. As a consequence on 2 August 2010 the respondent was rearrested on suspicion of making indecent images or pseudo-images of children under Section 1 of the Protection of Children Act 1978. The pen drives seized on the respondent's arrest however were found to be encrypted. During interview the respondent declined to answer any question, including questions in relation to the passwords and software applications that had been used to prevent access to the files. As a result application was made by the appellant to serve a notice on the respondent under section 49 of RIPA requiring disclosure of the encryption keys. It was that application that came before the learned judge and was refused.[4]We have been informed this morning that since these events the respondent has been rearrested on suspicion of further similar offences involving a further very large number of indecent images of children, quite separate from the images found on either the computers seized at the hostel and any material that may be or may not be on the pen drive seized on the same occasion. We are told that he pleaded guilty to a number of offences and on the 17th of this month that he was sentenced to a term of imprisonment for public protection with a minimum custodial term of 27 months.[5]We inquired of counsel as to the continuing desirability or necessity of the present proceedings in the light of these events. Mr Hamilton for the appellant Chief Constable submitted that the matter remained of public interest in the protection of prevention of crime because of the possibility of the encrypted material potentially disclosing either the victim of or perpetrators of this type of offence. He also submitted that, quite apart from that, the point arising is one of real public interest. We agreed therefore that we should continue to hear and determine the appeal.[6]RIPA contains the statutory provisions governing the interception of communications, surveillance activities, access to communications data and encryption of encrypted material. Section 49 of that Act creates a power to require disclosure of "any protected information") the term defined under Section 56 in the terms that I have already quoted. The power arises when the information has come into the possession of a person by means of the exercise of a statutory power to "seize, detain, inspect, search or otherwise interfere with documents or other property…”. The mechanism for securing disclosure is the service of the notice upon the person who is said to be in possession of the information, imposing a requirement of disclosure on that person. The exercise of the power to serve such a notice is subject to demonstration to a judge of the requisite level that there has been compliance with the necessary statutory preconditions. As I have said that was the application for such permission came before HHJ Steiger in November last year.[7]The learned judge refused the application and the present appeal is brought against that order. In his stated case of 25 January 2011 the learned judge stated the question in the opinion of this court in the following terms :
"The question at issue for the opinion of the High Court is whether, on the facts advanced and the relevant law, I was justified in refusing the application "
[8]Section 49(2) of the Act sets out the criteria for the applications, being based upon reasonable grounds for believing that :
“(a) that a key to the protected information is in the possession of any person, (b) that the imposition of a disclosure requirement in respect of the protected information is— (i) necessary on grounds falling within subsection (3), or (ii) necessary for the purpose of securing the effective exercise or proper performance by any public authority of any statutory power or statutory duty, (c) that the imposition of such a requirement is proportionate to what is sought to be achieved by its imposition, and (d) that it is not reasonably practicable for the person with the appropriate permission to obtain possession of the protected information in an intelligible form without the giving of a notice under this section” (i) necessary on grounds falling within subsection (3), or (ii) necessary for the purpose of securing the effective exercise or proper performance by any public authority of any statutory power or statutory duty, Subsection 3 provides: 9. "...disclosure requirement in respect of any protected information is necessary on grounds falling within this subsection if it is necessary— (a) in the interests of national security; (b) for the purpose of preventing or detecting crime; or (c) in the interests of the economic well-being of the United Kingdom.”
It is only paragraph (b) of that sub section that is material to this case.[9]In delivering the judgment of the Court of Appeal in the case of The Crown v S and Anr [2008] EWCA Crim 2177, Sir Igor

Judge P (as he then was) summarised the effect of these provisions in the following terms:

“In short, the exercise of the notificationprocess is predicated on the basis that electronic data which cannot readily be accessed or made intelligible without the key to it is already lawfully in the possession of the police (or other similar authority) and that the interests of national security or the prevention or detection of crime necessarily require its disclosure because no alternative, reasonable method of gaining access to it or making it intelligible is available. The disclosure request, and the consequent obligation imposed on the individual to whom it is addressed, must also be proportionate to its intended objective. The exercise of the power to require disclosure in these circumstances anticipates at least the potential for disclosure of information which may inculpate the individual to whom the notice is addressed: hence, no doubt, the statutory conditions and limitations on its exercise. 13. Failure, knowingly, to make the disclosure required by a notice lawfully issued under section 49 is a criminal offence, punishable on conviction with imprisonment, in a case involving national security, for a maximum term of 5 years, and in any other case, 2 years' imprisonment.”
[10]In the S case the facts were these. Someone called H was the subject of a control order under the Prevention of Terrorism Act 2005. S and A, the defendants, were alleged to have conspired together, with H and others, to breach that order and to have assisted H to abscond to a new address. At that new address the police found S in a room where there was a computer into which the key to encrypted files had been partially entered. S was arrested. His home address was searched and electronic materials were later retrieved from his computer hard drive which provided the basis for the charges against S under the Terrorism Act 2000. The home computer also contained encrypted files which could not be accessed. A was arrested on the same day and computer material including encrypted material was later seized from his address. S was charged with offences under the Terrorism Act 2000 and both men were charged with conspiracy to breach H's controlling order.[11]S and A were served with section 49 notices relating to the encrypted files requiring disclosure of a key or supporting information to make the information intelligible. Particulars were given of the precise circumstances in which the interests of national security and the prevention and protection of crime were said to arise. Neither S nor A complied with the notices on the basis that to be compelled to do so would be incompatible with the privilege against self-incrimination. Their refusal to comply led to charges being brought and two further counts being added to the existing indictment in that respect. The defendant's application for those two counts to be stayed was rejected by HHJ Stephens QC at a preparatory hearing. The defendants appealed against that interlocutory ruling under section 35(1) of the Criminal Procedure and Investigations Act 1996.[12]The Court of Appeal considered the extent to which the privilege against incrimination arose in that case. Reference was made to the well known decision of the European Court of Human Rights in Saunders v UK [1996] 2 BHRC at 358 where the court had said this:
“...the right not to incriminate oneself …does not extend to the use in criminal proceedings of material which may be obtained from the accused through compulsory powers but which have an existence independent of the will of the suspect, such as, inter alia, documents acquired pursuant to a warrant, breath, blood and urine samples and bodily tissue for the purpose of DNA testing”
[13]Evidence existing independently of the will of a suspect does not normally engage the privilege at all. It was said by Aikens J (as he then was) giving the judgment in the Court of Appeal in R v Kearns [2002] EWCA Crim 748 paragraph 53 as follows:
"There is a distinction between the compulsory production of documents or other material which had an existence independent of the will of the suspect or accused person and statements that he has had to make under compulsion. In the former case there was no infringement of the right to silence and the right not to incriminate oneself. In the latter case there could be, depending on the circumstances. … "
[14]Analysing that distinction from in S, Sir Igor Judge said this: 15. On analysis, the key which provides access to protected data, like the data itself, exists separately from each appellant's "will". Even if it is true that each created his own key, once created, the key to the data, remains independent of the appellant's "will" even when it is retained only in his memory, at any rate until it is changed. If investigating officers were able to identify the key from a different source (say, for example, from the records of the shop where the equipment was purchased) no one would argue that the key was not distinct from the equipment which was to be accessed, and indeed the individual who owned the equipment and knew the key to it. Again, if the arresting officers had arrived at the premises in Sheffield immediately after S had completed the process of accessing his own equipment enabling them to identify the key, the key itself would have been a piece of information existing, at this point, independently of S himself and would have been immediately available to the police for their use in the investigation. In this sense the key to the computer equipment is no different to the key to a locked drawer. The contents of the drawer exist independently of the suspect: so does the key to it. The contents may or may not be incriminating: the key is neutral. In the present cases the prosecution is in possession of the drawer: it cannot however gain access to the contents. The lock cannot be broken or picked, and the drawer itself cannot be damaged without destroying the contents. 21. As it happens, in the present cases, the only persons who know how to access the data to which access is being sought are the appellants themselves.[16]The last sentence is material in this case because HHJ Steiger distinguished the case of S on the basis that there was no evidence before him to indicate whether or not this respondent does know what the key to the appropriate file is.[17]The court in S held that the privilege against self-incrimination in that case was only engaged in a limited way. The keys themselves were not incriminating, but if they did give access to incriminating material the fact that the defendant's knowledge of the keys could become an incriminating fact. However, it was open to the judge to exclude from evidence the means by which the police could obtain access to it and therefore in the court's judgment the privilege against self incrimination was only engaged to a very limited extent. It held that the real question which arose was the extent to which any interference with privilege if engaged at all was proportionate and permissible. On this issue Sir Igor Judge said this :
“The material which really matters is lawfully in the hands of the police. Without the key it is unreadable. That is all. The process of making it readable should not alter it other than putting it into an unencrypted and intelligible form that it was in prior to encryption; the material in the possession of the police will simply be revealed for what it is. To enable the otherwise unreadable to be read is a legitimate objective which deals with a recognised problem of encryption. The key or password is, as we have explained, a fact. It does not constitute an admission of guilt. Only knowledge of it may be incriminating. The purpose of the statute is to regulate the use of encrypted material, and to impose limitations on the circumstances in which it may be used. The requirement for information is based on the interests of national security and the prevention and detection of crime, and is expressly subject to a proportionality test and judicial oversight. In the end the requirement to disclose extends no further than the provision of the key or password or access to the information. No further questions arise. The notice is in very simple form. Procedural safeguards and limitations on the circumstances in which this notice may be served are addressed in a comprehensive structure, and in relation to any subsequent trial, the powers under section 78 of the 1984 Act to exclude evidence in relation, first, to the underlying material, second, the key or means of access to it, and third, an individual defendant's knowledge of the key or means of access, remain. Neither the process, nor any subsequent trial can realistically be stigmatised as unfair.”
[18]The crux of HHJ Steiger's conclusion in the present case can be found at page 12 of the transcript in the proceedings before him between letters C and G. Quoting the judge, he said this :
"In the facts of the present case, there was, as I understand it, a no comment interview and there is no evidence to indicate whether or not the defendant does know what the key to the encrypted file is. Accordingly, as it seems to me, this case is different from that being dealt with by Judge Stephens at the Old Bailey, and it seems to me, applying the reasoning of the Court of Appeal to the facts of the present case, that the privilege may here be engaged, because for the defendant to reveal what the key was, would itself be incriminating material, there being no other independent evidence to show that he does know what the key is. It is likely, as it seems to me, that the defendant would in due course be charged, since he must answer his bail on 6 December. "
[19]Continuing at the bottom of page 12

the judge said this :

"I bear in mind that the purpose of the Act as defined at section 49(3), includes the purpose of preventing or protecting crime. It seems to me a relevant factor in striking the balance, as the Court of Appeal said it should be, that in this particular case the crime of being in possession of indecent images had been detected by the police, when they found what they had on the computers. Matters are not wholly clear, because the precise nature of those enquiries has not been fully set out, but for the moment I propose to refuse this application, on the grounds that to require the defendant to identify what the key to the pen drive is, might risk his privilege against self incrimination being taken away, since knowledge of itself is an incriminating fact. This does not rule out a later application once the facts become clear."
[20]This case, unlike that of S, concerns an application for permission to serve the notice under section 49 of RIPA. S was concerned with an application to stay a prosecution for offences of failure to disclose information after service of the statutory notice. The problem in this case is therefore at one remove from, and in advance of, that which arose before HHJ Stephens QC and the Court of Appeal in S. I bear in mind that distinction. However, I do not think it is one which assists the respondent here, since, as was pointed out in S, even if permission is granted in the case and the notice is served, it remains within the discretion of the judge in any subsequent trial as to whether evidence of the respondent's knowledge of the encryption keys, which is the only incriminating matter which did not exist independently from the respondent, should be admitted in evidence or not. There is also the statutory test of proportionality that exists itself under section 49.[21]It seems to me, with respect to the learned judge, took an extremely limited view of the evidence before the court as to what the respondent's knowledge of the key was. To my mind it was a perfectly legitimate inference to draw from the circumstances of recovery of the pen drives that the respondent might know encryption keys relating to the information stored on them.[22]On the present appeal two primary submissions have been advanced to the court by Mr Hamilton for the appellant. He submits, first, that the privilege against the self-incrimination is not engaged at all at the time when the application for permission to serve a notice under section 49 was raised. He argues that it only arises when the notice is served on the recipient and that recipient claims the privilege. Secondly, he submits that even if engaged the privilege is only to the very limited extent as it was in S and that the interference with it is wholly proportionate to the protection of the public and the interest to be served under the statute. In contrast, Mr Maguire for the respondent submits that the privilege is indeed engaged at the permission stage and that we should not interfere with the exercise of the judge's judicial discretion to refuse the permission at this stage, expressed as it was to be without prejudice to any later application.[23]In my judgment, as stated in paragraph 24 of the judgment in S privilege against self-incrimination may be engaged by the requirement of disclosure, that is it may arise at the permission stage. Indeed it seems to me that it did in the present case. However I consider that, as in S, the privilege in this case is engaged only to a very limited extent. I consider that the interference to that limited extent is entirely proportionate to the public interest within the meaning of section 49(2)(c) of the Act and that, insofar as the judge decided otherwise, he was wrong to do so. I note again the power of the judge at the subsequent trial after service of the notice of compliance or non-compliance with it to exclude evidence in relation to underlying material, the key or the means of access to it and the respondent's knowledge of the key or means of access to it as in his discretion seems appropriate. See again paragraph 25 of the judgment in S as quoted above.[24]For these reasons I would allow the appeal. I would answer the questions stated in paragraph 3 of the stated case in the negative. The application for permission to serve a notice under section 49 of the Act should have been allowed. It seems to me therefore that the proper course would be to remit the case back to the Crown Court for the direction of the requisite permission in writing be given.

Sir Anthony May:

[25]I agree that this appeal by case stated should be allowed for the reasons given by McCombe J, whose account of the facts and circumstances of the matter I gratefully adopt without repeating.[26]In my judgment the heart of the matter is this. An application for permission under schedule 2 of the 2000 Act for the purpose of Section 49 of the Act may give rise to a consideration of privilege against self incrimination at the time of granting permission: see paragraph 24 of the judgment of the now Lord Chief Justice in R v SF [2009] 1 WLR 1489. It appears from that paragraph and from paragraph 25 of the judgment that this may depend on the circumstances in which the protected information or relevant object comes for consideration for a disclosure requirement and that may turn on whether possession of knowledge of the encryption key may give rise to an inference of criminality. In any particular case it may or may not and that in turn may depend on what ever material is revealed when the encryption key is put into operation. In my view the circumstances of this case probably did give rise to a consideration of the question of self incrimination. Paragraph 24 of the judgment, however, makes plain that the extent to which the privilege against self incrimination may be engaged is very limited.[27]Privilege against self-incrimination is not absolute and it is plain that this statute does not intend that it should be. Section 49(2)(c) requires that the imposition of a disclosure requirement has to be proportionate to what is sought to be achieved. Since the nature of the disclosure is very likely to be concerned with criminal activity it is implicit from this that there may be circumstances in which it is proportionate to require disclosure even though the privilege against self-incrimination may arise for consideration to be a very limited extent.[28]It is evident from paragraph 25 of the judgment in S that there are a number of procedural safeguards against self incrimination at any subsequent trial which will very often and I think in this case, provide an entirely adequate safeguard. For this reason in my judgment the judge in the present case reached an unsustainable conclusion in deciding that he would not give permission. I think that it is quite plain that he should have given permission in the present case and Mr Maguire's submission that his refusal to do so was an exercise of judicial discretion which should not be disturbed is unpersuasive. I agree with Mr Hamilton that the facts of the present case falls so far in favour of a disclosure requirement that the judge's decision must be wrong.[29]Accordingly I agree that the appeal should be allowed and that the answer to the question should be as stated by my Lord and that we should remit the matter to the judge with a direction that he should give written permission under Schedule 2 of the Act.[30]Thank you very much. We are very grateful to you does anything further arise? MR HAMILTON: No my Lord SIR ANTHONY MAY: Thank you very much.