Passwords and prosecutions

The curious case of Oliver Drage.

When the news broke last week that a teenager had been given a custodial sentence for failing to provide his password to the police, the details of the story appeared incomplete.

The essentials of what had happened were as follows: Oliver Drage, 19 (and so only just a teenager), did not give a password to the police when formally requested to do so. He was prosecuted under the Regulation of Investigatory Powers Act 2000 and given a custodial sentence of 16 weeks in a young offenders institution (which may or not be regarded as the same as being "jailed").

However, the widespread media coverage of this conviction seemed problematic. Some things did not add up.

Let's start with the press release from Lancashire police.

Teen jailed for four months after failing to give up computer password

A TEEN who refused to give police officers an encryption password for his computer has been jailed for four months.

The case is believed to be the first of its kind in Lancashire.

Oliver Drage, 19, formerly of Naze Lane, Freckleton, was arrested in May 2009.

Drage's computer was seized but officers could not access material stored on it as it was protected by a 50-character encryption password. Drage was then formerly requested to disclose the password, which he failed to do.

Appearing at Preston Crown Court, Drage pleaded not guilty to failing to disclose an encryption key -- an offence covered by the Regulation of Investigatory Powers Act 2000. At his trial in September a jury took less than 15 minutes to find him guilty of the offence. Yesterday (Monday Oct 4), Drage was sentenced to 16 weeks in a Young Offenders Institution.

Detective Sergeant Neil Fowler, Blackpool Police, said: "Drage was previously of good character so the immediate custodial sentence handed down by the Judge in this case shows just how seriously the courts take this kind of offence.

Computer systems are constantly advancing and the legislation used here was specifically brought in to deal with those who are using the internet to commit crime. It sends a robust message out to those intent on trying to mask their on-line criminal activities that they will be taken before the courts with the ultimate sanction, as in this case, being a custodial sentence.

This press release is troubling for both what it does and what it does not say.

It is written in a tabloid-like and sensationalised way (for example, "TEEN" in screaming capitals), which seems to me to be deeply inappropriate for an official communication about a serious matter. It also refers to "those using the internet to commit crime...those intent on trying to mask their on-line criminal activities" when, on the face of it, no such charge had been made against this particular defendant and no prosecution carried out.

But when this press release was picked up by the newspapers, certain further information about Drage was published.

From the Guardian: "Oliver Drage, 19, of Freckleton, Lancs, had originally been arrested in May last year by a team of officers from Blackpool tackling child sexual exploitation."

And from the Daily Mail: "Teenager jailed for refusing to give computer password to police investigating child sex crimes"

But the press release did not mention child sex exploitation, nor did it mention the type of police officers who arrested him. Whatever Drage may or may not have stored on his computer, he had not been either charged for or convicted of any sexual offence.

However, his (distinctive) name was now associated with the investigation of serious sex offences by several newspapers on the back of a sensationalist press release which itself mentioned nothing about any sexual offences.

So I asked for further information about this from the press office of Lancashire police. First, I received information about the police team which had arrested Drage:

The Awaken Project is a very close working partnership between Blackpool Council and Lancashire Police and other.

The team is responsible for using an intelligence led and pro active approach to protect children in Blackpool who may be at risk of sexual exploitation. Police officers and social workers on the team are responsible for jointly investigating cases and targeting suspected offenders. Staff from health and education departments supplement the team in an effort to impact upon the behaviour of young and potentially vulnerable persons.

I was also told on the telephone the nature of the offence on suspicion of which Drage was arrested (even though he was not charged nor convicted). I asked why Lancashire police thought it appropriate to link the defendant's name with child sex allegations when he was neither charged nor convicted in respect of such serious matters. The response:

You will notice that that aspect was not mentioned in the official press release and was given to you as guidance over the telephone when you rang. It is therefore your decision if you wish to make that link in print.

I then pointed out the the child sex abuse aspects had been mentioned in many newspapers, and gave the examples of the Guardian and Mail above. Was I correct in my assumption that Lancashire police was their source for this extra information? The response:

The information was given as guidance to all journalists who rang and asked why Drage had originally been arrested. As previously mentioned, it is not included in the press release - so was not in the 'brief' we gave the press - and it is down to the individual publication if they chose to print that information.

Hope this helps.

I reverted, now asking why Lancashire police believed it was appropriate to mention it as guidance. After all, the defendant was now publicly and widely associated with child sex investigations (perhaps the most serious investigations one can be associated with) when he was neither charged nor convicted of any sex offence.

I will refer you back to my previous answer. The information was given as guidance (and was not included in the press release) to assist journalists in their reporting of the matter, by clarifying why Drage was arrested and his computer seized. Failure to give this guidance could have resulted in inaccurate assumptions and reporting of the case.

All journalists were pointed to the fact that this information was not in the press release and that it was their decision should they chose to publish the information that was given to them as guidance.

In contrast, the Crown Prosecution Service responded to my queries without any reference at all to the sexual offences for which Drage had been arrested. Indeed, for the CPS the prosecution was explicable on the straightforward facts of this particular offence:

Oliver Drage was found guilty on October 5, at Preston Crown court of failing to provide his computer's password contrary to section 53 of the Regulation of Investigatory Powers Act 2000.

The CPS received a file of evidence from Lancashire Police after he was served with a court order in December 2009 section 49 of RIPA 2000, requiring him to disclose the password.

He failed to do so within the three weeks' period specified on the order. After a thorough review of the evidence, we decided that there was sufficient evidence and it was in the public interest to prosecute Oliver Drage for this offence as his failure to disclose the password has obstructed an ongoing police investigation.

Evidence showed that the defendant admitted in police interviews that he had set an encrypted password of between 40 and 50 characters containing both letters and numbers using an encryption software programme and that he had had originally relied on his memory to recall it but could not recall it when he was served with the notice.

The jury heard both the prosecution and defence case and accepted the prosecution case that the defendant must have kept a record of this very complex password, rather than relying on memory, and that he had deliberately failed to disclose it to the police. They returned a guilty verdict after 15 minutes deliberation.

As the defendant claimed to have forgotten a password that he had previously memorised, it was for the prosecution to rebut this and to prove beyond all reasonable doubt that this was not the reason for the defendant failing to disclose it.

I also asked the CPS for what guidance it had for those who also may forget passwords, and their response was:

Part III of the Regulation of Investigatory Powers Act 2000 (the Act) and Investigation of Protected Electronic Information Code of Practice came into force on the 1st October 2007. The Code of Practice provides guidance to be followed when exercising powers under the Act to require disclosure of protected electronic data in an intelligible form or to acquire the means by which protected electronic data maybe accessed or put in an intelligible form.

Overall, there are two issues about this curious case.

First, there is the narrow issue of the prosecution and conviction. On the basis of the CPS statement, one can see why a claim to have forgotten a previously memorised encrypted password of between 40 and 50 characters, and not to have written it down elsewhere, would rather strain credulity.

Second, there is the worrying way in which highly prejudicial information is provided and published about an individual charged for and convicted of an offence very different for the one for which he was arrested on being on suspicion of having committed.

It may well be that Lancashire police break the encryption code.It could be that there is sordid material yet to be revealed which may have warranted a charge and even conviction of a serious sexual offence. We simply do not know. And neither do the Lancashire police.

However, in the meantime, an individual is now publicly associated with a serious investigation in respect of which was neither charged nor convicted; a police force publishes press releases as if they were tabloid stories and also furnishes highly-prejudicial information, but passes the buck if the press publishes it (which, of course, they will do); and the rest of us are really none the wiser whether a four month custodial sentence in this case was because of the gravity of the original suspicions or just for the implausibility of not knowing or noting down a 40 to 50 character password.

There is something not right here.

 

David Allen Green is a lawyer and a writer. He was shortlisted for the George Orwell blogging prize in 2010. He blogs for the New Statesman on legal and policy matters.

David Allen Green is legal correspondent of the New Statesman and author of the Jack of Kent blog.

His legal journalism has included popularising the Simon Singh libel case and discrediting the Julian Assange myths about his extradition case.  His uncovering of the Nightjack email hack by the Times was described as "masterly analysis" by Lord Justice Leveson.

David is also a solicitor and was successful in the "Twitterjoketrial" appeal at the High Court.

(Nothing on this blog constitutes legal advice.)

Getty.
Show Hide image

The Brexit Beartraps, #2: Could dropping out of the open skies agreement cancel your holiday?

Flying to Europe is about to get a lot more difficult.

So what is it this time, eh? Brexit is going to wipe out every banana planet on the entire planet? Brexit will get the Last Night of the Proms cancelled? Brexit will bring about World War Three?

To be honest, I think we’re pretty well covered already on that last score, but no, this week it’s nothing so terrifying. It’s just that Brexit might get your holiday cancelled.

What are you blithering about now?

Well, only if you want to holiday in Europe, I suppose. If you’re going to Blackpool you’ll be fine. Or Pakistan, according to some people...

You’re making this up.

I’m honestly not, though we can’t entirely rule out the possibility somebody is. Last month Michael O’Leary, the Ryanair boss who attracts headlines the way certain other things attract flies, warned that, “There is a real prospect... that there are going to be no flights between the UK and Europe for a period of weeks, months beyond March 2019... We will be cancelling people’s holidays for summer of 2019.”

He’s just trying to block Brexit, the bloody saboteur.

Well, yes, he’s been quite explicit about that, and says we should just ignore the referendum result. Honestly, he’s so Remainiac he makes me look like Dan Hannan.

But he’s not wrong that there are issues: please fasten your seatbelt, and brace yourself for some turbulence.

Not so long ago, aviation was a very national sort of a business: many of the big airports were owned by nation states, and the airline industry was dominated by the state-backed national flag carriers (British Airways, Air France and so on). Since governments set airline regulations too, that meant those airlines were given all sorts of competitive advantages in their own country, and pretty much everyone faced barriers to entry in others. 

The EU changed all that. Since 1994, the European Single Aviation Market (ESAM) has allowed free movement of people and cargo; established common rules over safety, security, the environment and so on; and ensured fair competition between European airlines. It also means that an AOC – an Air Operator Certificate, the bit of paper an airline needs to fly – from any European country would be enough to operate in all of them. 

Do we really need all these acronyms?

No, alas, we need more of them. There’s also ECAA, the European Common Aviation Area – that’s the area ESAM covers; basically, ESAM is the aviation bit of the single market, and ECAA the aviation bit of the European Economic Area, or EEA. Then there’s ESAA, the European Aviation Safety Agency, which regulates, well, you can probably guess what it regulates to be honest.

All this may sound a bit dry-

It is.

-it is a bit dry, yes. But it’s also the thing that made it much easier to travel around Europe. It made the European aviation industry much more competitive, which is where the whole cheap flights thing came from.

In a speech last December, Andrew Haines, the boss of Britain’s Civil Aviation Authority said that, since 2000, the number of destinations served from UK airports has doubled; since 1993, fares have dropped by a third. Which is brilliant.

Brexit, though, means we’re probably going to have to pull out of these arrangements.

Stop talking Britain down.

Don’t tell me, tell Brexit secretary David Davis. To monitor and enforce all these international agreements, you need an international court system. That’s the European Court of Justice, which ministers have repeatedly made clear that we’re leaving.

So: last March, when Davis was asked by a select committee whether the open skies system would persist, he replied: “One would presume that would not apply to us” – although he promised he’d fight for a successor, which is very reassuring. 

We can always holiday elsewhere. 

Perhaps you can – O’Leary also claimed (I’m still not making this up) that a senior Brexit minister had told him that lost European airline traffic could be made up for through a bilateral agreement with Pakistan. Which seems a bit optimistic to me, but what do I know.

Intercontinental flights are still likely to be more difficult, though. Since 2007, flights between Europe and the US have operated under a separate open skies agreement, and leaving the EU means we’re we’re about to fall out of that, too.  

Surely we’ll just revert to whatever rules there were before.

Apparently not. Airlines for America – a trade body for... well, you can probably guess that, too – has pointed out that, if we do, there are no historic rules to fall back on: there’s no aviation equivalent of the WTO.

The claim that flights are going to just stop is definitely a worst case scenario: in practice, we can probably negotiate a bunch of new agreements. But we’re already negotiating a lot of other things, and we’re on a deadline, so we’re tight for time.

In fact, we’re really tight for time. Airlines for America has also argued that – because so many tickets are sold a year or more in advance – airlines really need a new deal in place by March 2018, if they’re to have faith they can keep flying. So it’s asking for aviation to be prioritised in negotiations.

The only problem is, we can’t negotiate anything else until the EU decides we’ve made enough progress on the divorce bill and the rights of EU nationals. And the clock’s ticking.

This is just remoaning. Brexit will set us free.

A little bit, maybe. CAA’s Haines has also said he believes “talk of significant retrenchment is very much over-stated, and Brexit offers potential opportunities in other areas”. Falling out of Europe means falling out of European ownership rules, so itcould bring foreign capital into the UK aviation industry (assuming anyone still wants to invest, of course). It would also mean more flexibility on “slot rules”, by which airports have to hand out landing times, and which are I gather a source of some contention at the moment.

But Haines also pointed out that the UK has been one of the most influential contributors to European aviation regulations: leaving the European system will mean we lose that influence. And let’s not forget that it was European law that gave passengers the right to redress when things go wrong: if you’ve ever had a refund after long delays, you’ve got the EU to thank.

So: the planes may not stop flying. But the UK will have less influence over the future of aviation; passengers might have fewer consumer rights; and while it’s not clear that Brexit will mean vastly fewer flights, it’s hard to see how it will mean more, so between that and the slide in sterling, prices are likely to rise, too.

It’s not that Brexit is inevitably going to mean disaster. It’s just that it’ll take a lot of effort for very little obvious reward. Which is becoming something of a theme.

Still, we’ll be free of those bureaucrats at the ECJ, won’t be?

This’ll be a great comfort when we’re all holidaying in Grimsby.

Jonn Elledge edits the New Statesman's sister site CityMetric, and writes for the NS about subjects including politics, history and Brexit. You can find him on Twitter or Facebook.