Digital Searches in Ireland: Garda Powers Bill published

The Department of Justice, Home Affairs and Migration has published a draft Garda Síochána (Powers) Bill, with huge implications for digital searches in Ireland.

This follows on from a Heads of Bill originally put forward in 2021. There were clear problems with that proposal, which I discussed in the Irish Times at the time. Many of these were borne out by subsequent judgments which derailed the Bill for some years and ultimately forced a change of approach. In particular, the Supreme Court decisions in Corcoran and Quirke are clearly reflected in the revised Bill. Between them, these judgments have forced much greater emphasis on judicial authorisation of searches and handling legal privilege/journalist source protection, and Parts 3 and 4 are radically changed as a result.

The Bill appears to offer a much improved set of safeguards in relation to digital searches. However the devil is very much in the detail and the text will require close scrutiny. In particular, it will be interesting to see whether the Bill fully takes account of the CJEU judgment in CG v Bezirkshauptmannschaft Landeck, which seems to impose greater procedural safeguards than domestic law. At first glance the Bill also seems to duck the comity and proportionality issues presented by remote searches - which Maria Murphy and I discuss here (p.25).

A summary of the Bill is here.

Police powers to demand passwords - Poptoshev v DPP

Does a law violate the privilege against self-incrimination by requiring an individual to reveal a device password when a search warrant is being executed? The Irish High Court recently considered this issue in Poptoshev v DPP, holding that it doesn't.

In Poptoshev the applicant challenged sections 48 and 49 of the Criminal Justice (Theft and Fraud Offences) Act 2001. Section 48 allows gardaí with a warrant under that section to operate any computer at a place which is being searched, and to require any person at that place, who has lawful access to the information in any such computer, to furnish any password necessary to operate it. Section 49 criminalises failure to provide that password.

The applicant refused to provide passwords for two mobile phones and a laptop seized from him during a search of his home. When charged with failure to provide the passwords he brought a judicial review action claiming that this obligation, and the corresponding criminal penalty for failure to comply, amounted to a disproportionate interference with the privilege against self-incrimination under both the Constitution and the European Convention on Human Rights.

The High Court rejected this claim. The court held that the privilege against self-incrimination did not apply on the basis that 'the passwords in relation to each of these three devices existed independent of the will of the applicant', relying in particular on the similar English judgment in R v S (F). (An important aspect was that the applicant admitted ownership of the devices - there would have been a stronger self-incrimination claim otherwise.)

Separately, the High Court also held that mobile phones were included in the term 'computer' in the 2001 Act, which did not specifically define computers, and that the duty to provide a password applies 'there and then' while a search is being carried out and cannot be met by providing a password subsequently.

It is interesting that it has taken over twenty years for the constitutionality of this provision to be considered. There doesn't seem to have been many (if any?) prosecutions for failure to provide a password before now. According to a 2017 EU review of Irish law on cybercrime, Irish officials indicated that 'prosecution for withholding passwords is generally not done due to the right against self-incrimination' (p.68). After this judgment it's likely that these prosecutions will become more common.

Issues with the new Garda Powers Bill

I have a piece in today's Irish Times which identifies some serious concerns with the new Garda Powers Bill. Here's an excerpt:

The sensitivity of your phone means that this week’s proposal from the Department of Justice for a new Garda Síochána Powers Bill requires close scrutiny. That proposal would introduce a new power for gardaí, when carrying out search warrants, to demand your password or PIN and require you to biometrically unlock your phone (or tablet, or computer) using your fingerprint or face.

As well as taking a copy of everything on the device itself, gardaí could also use the device to access any other service you use – such as your webmail, cloud storage, or online banking – and then take a copy of that data also.

The way in which the searches would be carried out is concerning. Failure to comply with the demand there and then (with no right to consult a solicitor) would be an offence exposing you to immediate arrest, punishable by imprisonment for up to five years and a fine of up to €30,000. This power would also apply to the devices of “any person present at the place where the search is carried out”, including for example the parents or siblings of a suspect or someone who shares a house with them.

Full text

Search warrants and privacy in Ireland - CRH, Irish Cement & Lynch v. CCPC

The High Court gave a very important judgment yesterday (Independent.ie story) on the issues raised by the use of a search warrant to seize an entire email account where many of the emails in the account were not caught by the terms of the warrant. To grossly simplify a complicated decision, Barrett J. held that where the Competition and Consumer Protection Commission (CCPC) had seized an entire email account it was not itself entitled to carry out a "sifting" exercise to determine which emails fell within the scope of the warrant - instead, this had to be done by some impartial vetting process. In the lack of a suitable statutory mechanism, this could be done by agreement between the parties.

The full decision isn't yet on the courts.ie site, but courtesy of the CCPC I've uploaded a scanned copy to Scribd. The full decision will need careful consideration, but at first glance it's a very privacy protective decision which may have far reaching consequences in other areas of criminal procedure. Notably, it cites with approval the 2013 Canadian Supreme Court decision in R. v. Vu on the special privacy issues presented by searches of computers. (And, I'm glad to see, the Digital Rights Ireland litigation.) By requiring specificity in what is seized and how that material is then examined, it puts a question mark over other search powers - such as those under s.48 of the Criminal Justice (Theft and Fraud Offences) Act, 2001 - which are generally used so as to seize an entire computer and not merely specific records.

Downloading or accessing certain material could constitute a criminal offence

Poster put up in London internet cafes from 2010 onwards

Background:

It's not about asking owners to spy on their customers, it's about raising awareness," a police spokesman said, speaking anonymously in line with force policy. "We don't ask them to pass on data for us."Still, he said, police were "encouraging people to check on hard drives." He did not elaborate, saying it would be up to cafe owners to decide if or how to monitor what customers left on their computers.

PPS numbers: internet saviours?

Bank Holiday Mondays are quiet news days, making them a good time to get any old nonsense into the newspaper. Today is no exception as the Irish Times appears to have taken the opportunity for a special edition of breathless internet fear-mongering.

The prime example is this piece which makes the literally incredible assertion that "The PPS number provides the Irish Government with an opportunity to dramatically improve the safety of children and young people online." (Following on, no doubt, from the success of PPS numbers in the delivery of water services.) In effect, the author is demanding internet identity cards for the wider population. This is an astonishingly bad idea, as anybody with even a passing familiarity with the Korean internet ID fiasco should know.

So why is the author pushing this? The byline reveals that the author is "founder and CEO of TrustElevate, a technology products and services company that specialises in regulatory, policy and compliance online." But what the byline doesn't say is that her firm is selling the technology which the article promotes. According to its own site, "Trust Elevate is a UK-based technology solutions and advisory company. Our focus is on identity, privacy, security and safety from the perspectives of reputational compliance and commercial opportunities."

In short, the author is shilling her own service under the guise of an impartial opinion piece. This is bad enough in itself, but more fundamentally it is a distraction from what really needs to be done to protect children online.

At the most basic level, gardaí are dramatically under-resourced in dealing with the internet. The 2014 Garda Inspectorate report revealed there have been up to four year delays in analysing seized computers; that the Paedophile Investigation Unit had one (!) computer to receive and download evidence; that 40% of Garda stations are not networked and have no access to PULSE or internal email; that evidence cannot be shared electronically; and that even in networked stations many gardaí have no access to social media or external email.

One might expect that those genuinely interested in child welfare would address these basic points first. But where's the profit in that?


-----------

Some excerpts from the Garda Inspectorate Report - emphasis mine:

The current Garda Síochána IT system restricts the sending of evidence electronically, resulting in investigators having to travel to Dublin to view evidence. PIU only have access to one standalone computer to receive and download evidence, as they are unable to use PULSE. This is a fundamental tool for investigation of these crimes. When evidence arrives, it can take days to download information and this removes the availability of the computer to be used by investigators coming to the unit to view evidence for other cases. PIU gave an example where one case had over 8,000 videos.

Another problem area is the restriction placed on districts accessing social media sites. As a result, the PIU is swamped with requests from districts for help in cases under investigation. Since 2001, the unit has used a paper system for managing investigations and would like to move to an electronic system. Internally, the PIU uses an electronic spread sheet to monitor cases. There is a concern that two investigators could potentially be looking at the same suspect, without knowing that another garda is also investigating a crime against the same suspect. Like the SOMU, all PIU staff work on the same roster and again are all off-duty at the same time.

The delay in obtaining evidence from analysis of computers has contributed to a situation where no PIU investigation case file has been sent to the DPP for directions in the last four years of operation.

A consistent theme throughout the inspection of national and district intelligence units was that outdated IT equipment blocked them from accessing or viewing evidence about a crime. The Inspectorate was informed that the National Intelligence Unit is working on outdated software and is unable to load PDF documents and to view photographs. CIOs in particular experience daily challenges in accessing the necessary IT applications and equipment to perform their role effectively. CIOs often use personal laptops and computers to view CCTV footage, to download stills and to turn those stills into briefing documents and bulletins. This represents a risk of breaching security of intelligence data, but their motive is to ensure that intelligence is provided to local gardaí.

The access of gardaí to external e-mail was very inconsistent across the seven divisions. Some members stated that they had no external e-mail access and other gardaí explained that if you apply for access then it will be given. Many victims would like the option to use e-mail to communicate directly with the garda dealing with their case and it would ensure that the member actually received their message.

Will Irish courts take phone hacking seriously?

There's a remarkable story in today's Irish Independent about a woman whose criminal charges were struck out - without even a conviction - despite having been found guilty of listening to her former supervisor's voicemails. From the article:

A CIVIL servant who was found guilty of spying on her former supervisor by hacking into her mobile phone's voicemail messages has escaped punishment.

Dublin City Council employee Severine Doyle (39) had pleaded not guilty to 11 charges under the Postal and Telecommunication Act. However, following a hearing last June, she was found guilty of intercepting voice messages on a phone used by Teresa Conlon, Dublin City Council's head of housing allocation.

Dublin District Court heard that Ms Conlon's voicemail messages had been intercepted over a five-week period, from January 8 until February 11, 2010.

Doyle's sentencing had been adjourned until yesterday. Judge Eamon O'Brien told defence solicitor Declan Fahy: "I will strike it out with liberty to re-enter. I am giving her a chance, the ball is in her court."

During the trial on June 28 last year, Ms Conlon told the judge she found out that some city councillors had said they had listened to tapes of messages left on her phone.

This is an unusual outcome. The offences established carry a possible sentence of 5 years if prosecuted on indictment or 12 months otherwise. There were multiple incidents of phone hacking over an extended period. There was no guilty plea. The offences were aggravated by dissemination of the recorded material to councillors. Despite all this, the case was struck out. This may not have been a case for a custodial sentence, but I see no reason why a conviction shouldn't have been registered to mark the gravity of the offence. While there may be more to the matter than emerges from the media coverage, on the face of it this is a case where the court has failed to give adequate weight to the right to privacy in communications.

Microsoft joins the transparency movement (with an important Irish dimension)

Kudos to Microsoft for today publishing their first annual Transparency Report setting out details of how often national police forces seek to read customer content (such as emails) or to access other information on customers. This is done as part of their commitment as a member of the Global Network Initiative and it's striking, but alas not surprising, that this makes Microsoft considerably more transparent than the Irish government which refuses to reveal even this basic statistical information.

On to the data. In 2012, in relation to Microsoft products generally (Hotmail, Outlook.com, Messenger, etc.) Gardaí sought information in 72 different requests, relating to 222 different accounts. Of these requests, 5 resulted in user content being revealed (such as the actual contents of emails), 46 resulted in non-content user information being revealed (such as the IP address last used), 19 resulted in no data being found and 2 were rejected for not meeting legal requirements.

Skype, which Microsoft now owns, was treated separately. In relation to Skype Gardaí made 4 requests relating to 7 different accounts and there was no data disclosed in relation to any of those requests. (This mostly seems to be due to no data being found but records aren't available for the entire year.). Also, in 2 cases the Skype support team provided general guidance to Gardaí regarding the procedures for accessing customer data.

There's an interesting comparison here with Google's Transparency Report. The overall numbers of requests by Gardaí to Microsoft and Google are very close (76 total for Microsoft for all of 2012; 34 for Google for the first six months of 2012). However the numbers of requests which result in information being provided are very different. In the case of Google data was provided in reply to just 2 of 34 requests (6%), while Microsoft provided data in response to 51 of 76 requests (67%). It's impossible to know without more information why that is and the low Google response rate might be just a blip for the particular six month period - nevertheless the difference is striking.

Significantly, Ireland was one of only four countries other than the US where user content was disclosed, the others being Brazil, Canada and New Zealand. The report doesn't make it clear why this is, but the FAQs imply that this may be due to Hotmail and Outlook.com accounts being hosted in Ireland and therefore being subject to local law.

The report also glosses over a question which has long interested me - what's the legal basis on which Microsoft will provide the contents of emails to Gardaí? Here's what the FAQs have to say:

What laws apply to Microsoft and Skype customer records and content? 

Irish law and European Union directives apply to the Hotmail and Outlook.com accounts hosted in Ireland...

How does Microsoft and Skype determine what law enforcement entities are able to request data? 

Microsoft must produce data in response to valid legal requests from U.S. and Irish law enforcement entities because we are headquartered in those jurisdictions or because we host data in those countries. Microsoft may disclose non-content data pursuant to a law enforcement request after it is validated locally and transmitted to our compliance teams in the U.S. and Ireland...

So - what exactly is a "valid legal request"? Irish law on interception doesn't seem to extend to webmail, suggesting that Microsoft are simply acting in response to non-statutory Garda requests rather than requiring a Ministerial warrant as would be required for telephone tapping. If so, the relevant law would be s.8 of the Data Protection Acts 1988 and 2003, which allows (but doesn't require) voluntary disclosures of user information in the context of criminal investigations. This would, however, be worrying if true as it would allow Garda access to email contents without any outside scrutiny (no Ministerial warrant or court order required) and without the other safeguards which would apply to telephone tapping - so no judicial oversight after the fact and no complaints mechanism available.

If this is the case then it would also put Ireland in breach of our obligations under Article 8 of the European Convention on Human Rights, which states that interferences with private communications must be "in accordance with the law", requiring that there should be a clear legal basis along with adequate mechanisms in place to oversee and guard against abuses of surveillance. (See in particular Klass v. Germany and Malone v. UK.)

More clarity on this point is required, and as soon as possible the law should be changed to ensure that emails enjoy the same protections as telephone calls.

Testifying before the Oireachtas Social Media Hearings

I appeared today along with my colleague Fergal Crehan on behalf of Digital Rights Ireland before the Oireachtas Joint Committee on Transport and Communications which is currently holding a series of hearings on "Social Media Ethics and Regulation". There's a good summary of the proceedings in the Irish Times but the masochistic amongst you can watch the whole thing here. Our slides and Fergal's very comprehensive written submissions are embedded below.

I won't rehash here the substance of the discussion, but I should say that we got a very fair hearing from the Committee whose members - following four separate sessions on the topic - are now very familiar with the issues (previous sessions: 1|2|3). They were quite receptive to the argument that greater resources are needed for the Data Protection Commissioner and the Garda Computer Crime Investigation Unit, and I suspect that they were as shocked as I was to discover that there is currently a three year backlog for that unit to investigate child pornography cases.

The hearings as a whole were also useful in highlighting current practice in sites such as YouTube and shedding some light on the otherwise rather opaque Office for Internet Safety in the Department of Justice. I was disappointed though that there was no evidence from domestic social networking sites such as Boards.ie - the larger international players such as Facebook, Twitter and YouTube operate in a very different environment, not least in the resources they have, and it would be unfortunate if the Committee were given the impression that they were typical of social media sites generally. I don't know whether the domestic absence is because local sites didn't seek to be heard, or whether they weren't given time - but either way it seems to me that these sites would benefit from joining forces and possibly setting up a group to represent their views. In any event I look forward to seeing the Committee's report.

Social Media and the Law: Presentation to Joint Committee on Transport and Communications

Written submissions on abuse in social media

Illegally obtained digital evidence: Mind your Ps and Qs

"While the law provides for court orders to be made for the preservation and obtaining of evidence for the purpose of future legal proceedings, claimants, or potential claimants, sometimes resort to measures of self help, by copying, seizing, or attempting to access digital copies of documents" - Tugendhat J. in L v. L. (2007)

Those words from the English High Court are equally true in Ireland. Particularly in family law cases it can be very easy for a litigant to (illegally) access the laptop, webmail or other electronic information of the other side to collect ammunition for use at trial. This presents interesting legal issues as to when such evidence will be admissible, despite the way in which it was obtained.

The High Court gave a recent judgment in the family law case P v. Q [2012] IEHC 593 which offers some guidance. In this case the applicant (the husband) sought a judicial separation and attempted to introduce evidence relating to the respondent's (wife's) sexual activities since the breakup of their marriage, including details of material on her laptop and posted by her to certain websites. The respondent gave evidence that the passwords for her laptop and the access codes for the sites were kept in a locked safe which the applicant must have accessed illegally. Consequently she sought to ensure that the information obtained by the applicant was not used in the proceedings and in particular was not used as the basis to obtain an order for discovery against her.

On appeal from the Circuit Court, the High Court held that in the ordinary course of events this information would be inadmissible on the basis that it was obtained illegally and in breach of the constitutional right to privacy of the respondent. In this case, however, given that child welfare issues also arose the court took the view that the constitutional rights of the child took precedence over the manner in which the evidence was obtained so that the information could be admitted in relation to the child welfare issues only. The relevant parts of the judgment are at para. 33 onwards:

33. The issue for the court to determine is complicated by the allegation that the respondent’s privacy was breached illegally when the codes and passwords of her personal laptop were accessed, at a time subsequent to the commencement of family law proceedings Although disputed by the applicant, the evidence before this court heard on affidavit would indicate that the passwords and access codes to these particular websites were retained by the respondent in a locked safe. There are many occasions and opportunities in family law proceedings, where parties to the proceedings access information which the other party regards as private, but which has not been obtained illegally. In this case the acquisition of the codes is tainted by illegality.

34. I accept the submissions on behalf of the respondent, that there is a broad principle of constitutional law, that evidence which is obtained by invasion of a constitutional personal right such as a right of privacy must be excluded unless the Court is satisfied that the breach was committed unintentionally or accidentally (which could not be the case here) or is satisfied that there were extraordinary excusing circumstances which justify the admission of the evidence in its discretion”. It is respectfully submitted that there are no extraordinary excusing circumstances in this appeal. I would accept that principle as applying to a criminal prosecution, in order to protect the absolute right to a fair trial.

35. Where different constitutional rights have to be balanced, different principles apply.

36. A court should always be reluctant to admit evidence or approve discovery, which is tainted with illegality, but that is not to say that on all occasions where illegality is suspected or found, that the evidence so obtained is not admissible. This is particularly so when dealing with the welfare of a child.

37. If the court were only dealing with issues between the parties and not the welfare of the child, the court would have taken into consideration the sexual history of the marriage, and on balance would not make the order for discovery sought..

39. The alleged sexual activity of the respondent has a direct bearing on the welfare of the child of the marriage...

41. While the proceedings touching on the welfare of the child are adversarial in nature, there is an inquisitorial aspect to that portion of the proceedings dealing with his custody. Balancing the different constitutional rights and responsibilities the welfare of the child would take precedence over illegally gathered information touching on the child’s welfare.

42. In addition the constitutional right to privacy of the respondent is protected in “in camera” proceedings, as the information disclosed is confined to the parties, their legal representatives and the court. The respondent’s rights can be further protected by the addition of further conditions.

43. The court affirms the order of the Circuit Court with the following additional conditions:-

(1) The material furnished can only be used for the purposes of determining the welfare of the child of the marriage and not for the purposes of s. 16(2)(i) of the Act in respect of the behaviour of the respondent.
(2) Any material discovered which does not impinge on the child’s welfare, should be furnished but returned to the respondent, and not relied on by the court.
(3) In the event of any dispute the presiding judge of the Circuit Court should consider the material and decide on relevance

While this decision allowed the use of this information on the particular facts of the case for a limited purpose, overall it adopts an approach which will mean that in most future cases such evidence will be inadmissible. The judgment isn't entirely clear on the distinction between illegally and unconstitutionally obtained evidence but appears to accept the proposition that wrongful access to a laptop or an online account will amount to an invasion of the constitutional right to privacy - not merely an illegality. In this, it extends the principle previously established in PMcG v. AF in relation to hardcopy (a diary in that case) to digital information also.

Impact of the Criminal Justice Act 2011 on cybercrime law

One of the most important recent developments in Irish criminal law has been the enactment of the Criminal Justice Act 2011 which makes substantial changes to both the substantive and procedural law surrounding offences of dishonesty and "white collar crime" (previously). While the 2011 Act is of very wide application, it has particular significance for computer crime where it creates both duties to report certain types of crime and new police powers to require the handing over of passwords and decryption of files.

Pearse Ryan and Claire O'Brien of Arthur Cox and Andy Harbison of Grant Thornton have produced a very good guide to the effect of the 2011 Act for the Society of Computers and Law (paywalled) and with their kind permission I'm glad to be able to host a copy here:

Cybercrime in Ireland – Recent Legislative Developments

The Criminal Justice Act 2011 (the “2011 Act”) came into effect on 9th August 2011 and was enacted with the aim of granting An Garda Síochána (the Irish national police service) more extensive powers to investigate “serious and complex offences”. (1) The main areas which the 2011 Act deals with are the supply of information at investigation, detention, questioning and the summoning of witnesses.  Much attention has focused on the 2011 Act as a tool in the fight against white collar crime, a topic of much interest since Ireland’s economic crisis.  In the press statement released by the Minister for Justice, Equality and Defence, Mr Alan Shatter, it was stated that the 2011 Act is “an important step in delivering on the Government’s strong commitment to tackle white collar crime as set out in the Programme for Government”.(2)

This article focuses on the 2011 Act as a tool in the fight against cybercrime, a specific sub-species of white collar crime.  While cybercrime may not pose the same threat to national economic well-being as some of the criminal acts, the investigation and accordingly the prosecution of which the 2011 Act was intended to assist, with particular reference to the financial services sector, cybercrime is a material and ever increasing area of criminal activity.  Also, it is an area in which the Gardaí were previously severely hampered in their ability to investigate, with a knock-on effect on prosecutions.

This article follows on from an earlier article entitled ‘Computer Fraud in Ireland’.(3)  

Purpose of 2011 Act

The problems which the 2011 Act attempts to tackle are problems which potentially both significant delay and potentially hamper the investigation and prosecution of white collar crime.  Cybercrime in particular, is frequently orchestrated on a large if not massive scale and in an increasingly complex manner, as technology develops at a rapidly increasing pace. 

The level of resources deployed by organisations to secure their IT systems has increased substantially in recent years.  Correspondingly, the level of technical sophistication necessary to establish a breach in most organisations’ IT networks, and particularly those in the financial services industry, has also had to increase.  Organisations’ cyber-defences now typically take a lot more effort and wherewithal to breach.  Now, more than ever to become a success in cybercrime it is necessary to be intelligent, patient, innovative and well resourced, none of which are characteristics typical of most criminals.  Cybercrime, or at least those areas of it that are more than computerised petty theft, therefore falls increasingly within the domain of organised criminals.(4) 

National authorities responsible for investigation of all forms of cybercrime are almost invariably at a technological disadvantage, as the criminals make the running.  The 2011 Act attempts to go some way towards lessening delays which hamper the investigative process.  

Scope of 2011 Act

Section 3(1) of the 2011 Act brings a number of relevant offences within its ambit, among them Section 9 of the Criminal Justice (Theft and Fraud Offences) Act 2001 (the “2001 Act”) and Sections 2, 3 and 4 of the Criminal Damage Act 1991 (the “1991 Act”).  These offences are summarised below, but are discussed in some detail in the previous article referenced above.

Additionally, Section 3(2) provides that the Minister may, by order, specify as a relevant offence, any arrestable offence relating to criminal acts involving the use of electronic communication networks and information systems or against such networks or systems or both, if the Minister is of the opinion that the nature of the offence is such that it would benefit from the powers conferred on the authorities in the 2011 Act, due to, for example, the complexity of transactions involved and the prolonged period of time usually required for investigation.  It remains to be seen whether any such offences will be specified pursuant to Section 3(2). 

Section 3(2) appears to be a recognition that the 1991 Act and 2001 Act were rendered effectively obsolete by technological innovations quickly after being passed.  Nevertheless, it does not solve the problem that an offence has to be rendered arrestable before it can also be designated as reportable, a problem when Irish authorities have historically had difficulty keeping up with the apparently boundless imaginations of cyber criminals when applied to developing new varieties of IT fraud and cybercrime.

Sections 2 and 3 of the 1991 Act respectively create the offences of damage to, and threat of damage to, property, including damage with an intention to defraud.  Section 4 of the 1991 Act created the offence of possessing anything with intent to damage property with a similar intention to defraud another.   Section 9 of the 2001 Act relates to the dishonest operation of a computer whether within or outside the State with the intention of making a gain, or of causing loss to another. 

It is notable that Section 5 of the 1991 Act remains outside of the remit of the 2011 Act.  Section 5 is a computer-specific offence and deals with persons who, without lawful excuse, operate a computer within the State with intent to access any data kept either within or outside the State, or outside the State with intent to access any data kept within the State, whether or not any data is actually accessed.  Given the specific acknowledgements in the 2011 Act of the role played by technology in serious and complex offences, it is surprising that Section 5, with its obvious focus on hacking and data security has been excluded from its application.  It is possible that the drafters of the 2011 Act doubted the ability of citizens to reliably and accurately identify the kind of offences covered under Section 5 of the 2001 Act, which would render any legal obligation to report such offences excessively onerous.  Hacking offences can be difficult to identify where the perpetrators intention was to remain undetected, which is frequently the case and particularly with more sophisticated hacking.  It might also be noted that resource allocation to the Gardai’s Computer Crime Investigation Unit have failed to keep up with growth rates in IT usage over recent years.  An obligation to report computer offences would thus not necessarily be reflected in an increase in investigative activity.

Key Provisions of 2011 Act

Under Section 15 of the 2011 Act a member of the Garda Síochána may apply to a judge of the District Court for an order to make available particular documents or described documents available or to give information for the purposes of the investigation of a relevant offence.  In the case of documents being handed over under this section which are illegible or inaccessible, the court order may also stipulate that any relevant access or passwords be given.  Failure to provide passwords can be punished by a fine or prison term of up to 12 months on summary conviction or 2 years on indictment. 

Requiring passwords is a significant power, given that without the key the lock remains unopened.  Investigation of cybercrime offences can clearly be substantially frustrated by the lack of access to encrypted documents, as demonstrated, for example, in recent Garda investigations at Anglo Irish Bank.(5)  This section provides the Gardai with considerable additional leverage.  The 2001 Act only allowed for penalty of IR£500 or 6 months for failure to disclose passwords and as far as we are aware these penalties were never imposed.

The Superior Courts in Ireland have on occasion in recent years issued Anton Pillar Orders and other civil warrants which required individuals to disclose passwords to representatives of Civil plaintiffs, under threat of being held in contempt and summarily jailed.  In practice this has meant that private persons have potentially had more scope to force other parties to disclose their password than have the police.  A fact of necessary concern to Gardai.

Section 16 deals with the assertion of privilege over documents which fall subject to an application under Section 15 and allows for the Garda Síochána to apply for a determination as to whether privilege can be claimed, which application may be made in camera.  This provision will be of benefit in the context of the speed at which cybercrime offences can become opaque and tackles a significant area of delay in criminal prosecution. 

Section 18 of the 2011 Act allows for certain reasonable presumptions to be made in the context of the Criminal Evidence Act 1992 in relation to the authorship or exchange of documents by virtue of the circumstances in which the document is found or purports to be exchanged.  In IT forensics, it is typically relatively straightforward for expert investigators to establish that actions were carried out on a computer by persons using a particular user account or other privileges.  It has historically been far more difficult to link specific individuals with user accounts – to place their hands on the keyboard.  The new provision allows the Courts to assume that the individual in possession of a certain set of user credentials was the same person who carried out any acts on the computer using those credentials.  It is up to the defence to demonstrate that others might have been able to use the same credentials to carry out a crime.  These provisions will be of particular relevance to the use of electronic documents in the course of investigation and the use of evidence in criminal trials. 

Under Section 19(1) of the 2011 Act it is an offence for a person to withhold information which they believe might be of material assistance in preventing the commission by another person of a relevant offence or securing the apprehension, prosecution or conviction of any person for a relevant offence and the person fails without reasonable excuse to disclose the information to the Gardaí.  This offence attracts a penalty of a class A fine (maximum €5,000) and/or 12 months imprisonment on summary conviction and an unlimited fine and/or imprisonment not exceeding a period of five years on conviction on indictment.  The Gardaí may arrest and detain, for up to 24 hours, an individual without a warrant if they are suspected of withholding information.(6)  

It is our understanding that this obligation may apply retrospectively so that, in theory, matters that individuals and organisations might have thought long closed should be reported to the Gardai regardless.  This is an area of concern amongst those likely obliged to report offences, although not an area that has attracted much public comment.

Section 19 is the provision of the 2011 Act which has attracted most attention within the public and private sectors.  This provision represents a clarification in the law, creating for the first time a specific obligation to report relevant information to the authorities.  While this provides obvious advantages for the Garda Síochána in investigation of serious crime, it has caused a degree of concern to public and private sector organisations, who may now be guilty of an offence if they fail to report information covered by the provision.  This could potentially apply in circumstances of omission by default, where the organisation may not be actively aware that relevant information is in their possession.  While it is assumed that the normal rules in relation to knowledge and possession of evidence, together with normal Gardai operational practice and procedure, will apply in the application of this Section, there is an element of doubt here which is a cause for concern amongst public and private sector organisations who may be have suffered cybercrime, together with third parties, such as IT security or forensics consultants brought in to investigate technical aspects of an incident, which may take some time to be identified as a crime.  This Section was introduced to solve a perceived problem, but the tariffs applicable to the new offence in particular have caused disquiet amongst those under an obligation to report.

It should be noted that Section 19 has essentially reinstated the offence of Misprision, which had been removed from Irish law by the Criminal Law Act 1997(7), for all but terrorist offences.(8)  Misprision was formerly a common law misdemeanour committed by a person who knew that a felony had been committed but did not give information which could lead to the felon’s arrest.(9)  Minister Shatter stated at the Second Stage reading of the 2011 Act, in relation to Section 19, that “this particular offence is of major importance, as its creation in the Bill will ensure that those who become aware of persons engaging in white collar crime are under an obligation to bring what they know to the attention of the Garda Síochána” .(10)

One provision the 2011 Act does not include is any allowance to provide additional resources to the Gardai to investigate the offences which it is intended be reported to them under its provisions.  Nor has the Government allocated any additional resources to the Garda Bureau of Fraud Investigation or to the Garda Computer Crime Unit in response to this new legislation.  As a consequence it appears the main effect of the Act may be to deluge the law enforcement authorities with reports of possible offences without providing them any means to investigate them.  It is therefore very much an open question whether in this regard the 2011 Act is anything more than a ‘paper tiger’.

2011 Act Overview and Summary

The 2011 Act introduces a wide arsenal of powers aimed at aiding the investigation of serious offences which in the context of cybercrime are generally long overdue and are to be welcomed.  The quite serious tariffs applicable under Section19 have been less welcomed by those likely to suffer cybercrime as well as the IT forensics sector, who may be ones who discover the crime. 

While the 2011 Act incorporates approximately 130 offences into its remit, one significant omission is reference to Section 5 of the 1991 Act, which relates to unauthorised use of a computer with intent to access data, which was intended to deal with hacking.  The reason for this omission is assumed to be attributed to the same logic which associates the offence under the 1991 Act with damage to property and applies comparatively small tariffs.  Under the 1991 Act a general offence relating to damage to property is stated, with property defined to include data.  This is thus a fairly basic cybercrime related offence.  Notwithstanding, the relative merits of Section 5 of the 1991 Act, by omitting reference to it the 2011 Act has disregarded one of the main types of cybercrime offence, namely hacking (albeit a particular type of hacking) that the new broad powers of investigation would seem to have been intended to tackle. 

Significant steps have been taken by the 2011 Act to make inroads on issues which hamper the effective investigation of complex and technical crimes.  This is welcome.  However, overall the law applicable to substantive cybercrime offences, as set out in the 1991 Act and 2001 Act, requires significant revision, to update what are by now elderly offences.  Without a more focused and sophisticated legislative framework cybercrime will remain an area where the law lags behind the crime. 

Pearse Ryan is a partner in the Technology & Life Sciences Group at Arthur Cox, Dublin, specialising in IT, outsourcing, cloud computing and IT security issues.  Claire O’Brien is a trainee solicitor in the Technology & Life Sciences Group at Arthur Cox, Dublin.

Andy Harbison is a Director – IT Forensic Lead, Forensic & Investigation Services, at Grant Thornton, Dublin, specialising in computer forensics and electronic discovery.

Pearse and Andrew wish to express their thanks to Claire for her valuable contribution to this article.

Footnotes:

1.   Criminal Justice Bill 2011 Second Stage Speech (Dáil) on Wednesday, 18 May 2011Minister for Justice, Equality and Defence, Mr Alan Shatter, T.D.
2.   Press release of the Minister for Justice, Equality and Defence, Mr Alan Shatter T.D http://www.justice.ie/en/JELR/Pages/CrimJustBill2011_PR
3.   Article published by the Society for Computers & Law, available at: http://www.scl.org/site.aspx?i=ed16653.  Also available at:  http://www.arthurcox.com/who-we-are/our-people/pearse-ryan.html
4.   For example, 21/12/12 story entitled ‘Facebook helps FBI take down $850m cyber-gang’, available at: http://www.finextra.com/News/FullStory.aspx?newsitemid=24372
5.   See: http://www.independent.ie/national-news/anglo-chiefs-facing-quiz-on-missing-passwords-2413749.html
6.   For a general discussion of S19 see:  http://www.arthurcox.com/uploadedFiles/Publications/Publication_List/Arthur%20Cox%20-%20The%20Criminal%20Justice%20Act%202011,%20September%202011.pdf
7.   In this Act, Section 3 abolishes the distinction between felony and misdemeanour, thereby abolishing the felony of misprision.
8.   Section 9 of the Offences Against the State Act, 1998 creates an offence similar to misprision.  In this section it is an offence to withhold information which a person knows or believes might be of material assistance in preventing the commission of a serious offence or securing the apprehension  prosecution or conviction of any other person for a serious offence,
9.   See for example Sykes v. DPP [1961] 3 All ER.
10.   http://debates.oireachtas.ie/dail/2011/05/18/00025.asp

Fresh claims that Irish police have been hacked

It's been an embarrassing time recently for Irish police, following allegations that Lulzsec hackers were able to compromise the personal email accounts of senior gardaí, enabling them to record a FBI hosted conference call involving international computer crime specialists. Interestingly, Monday's Daily Mail had a story (which doesn't seem to have been picked up by other Irish media) suggesting that there have been wider breaches of garda security. Excerpt:

A MAJOR Garda security alert into phone and email hacking of the country's highest ranking officers is under way.

The Mail can reveal that deputy commissioner Noirín O'Sullivan has ordered an investigation into apparently widespread phone and email hacking of senior gardaí.

It is understood the investigation has established that Pulse, the Garda intelligence system, has not been compromised.

However, senior security sources say that the emails and phones of senior gardaí have been hacked.

The investigation is attempting to establish the extent of the hacking and for what purpose confidential garda information is being targeted.

The probe has established that the head of police in another European country has had his email illegally accessed by an Irish-based hacker.

At least two other senior police officers in other European forces have had their email compromised.

The investigation is being taken 'extremely seriously' by Garda management and checks are under way on senior officers' phones and emails to see if they have been illegally accessed.

Some gardaí have had their phones and emails hacked, but because of the sensitive nature of the investigation, senior sources could not reveal what exactly has been accessed. A file is being prepared for the Director of Public Prosecutions. One key aspect of the probe is trying to establish for what purpose the hacking was initiated. It is understood that gardaí checking to see if online Irish based hackers are sharing the confidential information that has been hacked with others internationally...

As one of the State's two deputy commissioners, Noirín O'Sullivan holds the second most senior rank in the force, with responsibility for operational policing and national security.

The fact she ordered the investigation indicates how seriously the matter is being taken by Garda management.

Anonymous attacks on Ireland will hurt, not help the case against blocking

My heart sank when I saw this tweet a few minutes ago:

Ireland has angered the hive, we will be reporting all attacks through this account | #OpIreland #OpMegaUpload

— Anonymous (@YourAnonNews) January 24, 2012

Leave aside, for a moment, the inconvenience and disruption this will cause people trying to make use of government sites, the cost of responding and the controversial question whether denial of service attacks are legitimate as a type of civil disobedience. Quite apart from all these points, the action will do nothing to advance the Anonymous goals.

Until now the Irish campaign against internet blocking proposals has been remarkably effective at getting the issue onto the public and political agenda. With the help of the StopSOPAIreland site, the proposed law has shot from almost no public awareness to national prominence in just a few days, and has seen some Irish politicians genuinely engaging with our concerns. It also is giving many Irish netizens a grounding in political advocacy, something that will help as we confront more of these issues in future.

The Anonymous attacks, if they go ahead, will jeopardise this - making it easier for the music industry to spin critics as criminals, and giving unsympathetic politicians an easy, crowd pleasing reason to ignore the campaign. If the headlines shift from "New law threatens civil liberties" to "Hackers attack Irish government websites" then we will be on the back foot, jeopardising what's been achieved to date.

I don't think Anonymous tend to reconsider their targets once chosen. But if they do, now would be a good time to rethink the Irish attack.

Ireland to extradite "Boards.ie hacker"?

Continuing our series of "interesting stories lost behind the Sunday Times paywall", John Mooney and Mark Tighe reveal that the DPP has directed the extradition of a Latvian man suspected of involvement in the January 2010 hacking of Boards.ie [subscription only].

According to that article:

Gardai from the force's computer crimes unit quickly traced the hacker to Latvia but it is only in recent weeks that the Director of Public Prosecutions (DPP) has ordered the suspect to be extradited. The DPP has directed that there is enough evidence to secure a conviction...

Legal sources said it may be possible for the boards.ie suspect to be charged with theft or fraud: some of the passwords obtained in the hack appear to have been used to steal money from people's Paypal accounts... The hacker is suspected of downloading a number of databases to order.

Background on the attack on Boards.ie: 1|2.

Impact of the Criminal Justice Bill on the investigation of cybercrime

The Minister for Justice yesterday published the Criminal Justice Bill 2011 (pdf) which is primarily aimed at white collar crime and unsurprisingly aims to facilitate the investigation of banking and financial crimes in particular (press release | Irish Times). It will, however, also have a significant impact on the investigation and prosecution of cybercrime.

Under section 3, the Bill applies to “relevant offences” which, as set out in Schedule 2, includes the offence of dishonest use of a computer. In addition, the Bill allows the Minister to add crimes to the list of "relevant offences" including "criminal acts involving the use of electronic communications networks and information systems or against such networks or systems or both". Consequently, assuming the Minister uses this power, the majority of computer crimes are likely to be subject to the provisions of this Bill.

As summarised in the press release, the key parts of the Bill are:

• A new system to make more effective use of detention periods. This will allow persons arrested and detained for questioning by the Gardaí to be released and their detention suspended so that further investigations can be conducted during the suspension period.

• New powers for the Garda Síochána to apply to court for an order to require any person with relevant information to produce documents, answer questions and provide information for the purposes of the investigation of relevant offences. Failure to comply with such an order will be an offence.

• Measures relating to how documents are to be produced to the Gardaí. These measures are aimed at reducing the delays associated with the production of large volumes of poorly ordered and uncategorised documents to the Gardaí in the course of their investigations.

• Measures to prevent unnecessary delays in investigations arising from claims of legal privilege.

• The creation of a new offence, similar to the former misprision of felony offence, which relates to the failure to report information to the Gardaí.

Also, though not mentioned in the press release, s.18 of the Bill will make the admission of documentary and electronic evidence in criminal trials significantly easier by establishing new presumptions regarding the creation, ownership and receipt of documents.

These provisions would dramatically change the rules governing the investigation and prosecution of computer crime in Ireland. Take two examples. The proposed offence of failing to report information would create a positive duty to report computer crimes to the Gardaí - with failure to do so carrying a term of imprisonment of up to five years. One wonders whether this is workable and what effect it might have on the work of computer security researchers. Similarly, the new power to order the production of documents includes a requirement that such documents be provided in decrypted form or that a password be provided (s.15(6)), which appears to address the gap in the law revealed by the encrypted Anglo Irish Bank files.

This is certainly one to watch for anyone with an interest in cybercrime in Ireland, and I'll be coming back to it as it progresses through the Oireachtas.