New clause 8 - Encrypted data and indecent images of children

Sexual Offences Bill [Lords] – in a Public Bill Committee am 5:45 pm ar 14 Hydref 2003.

Danfonwch hysbysiad imi am ddadleuon fel hyn

'(1) This section applies to anyone who has been convicted of an offence to which Schedule 3 of this Act applies.

(2) Where a police officer, in pursuance of a warrant granted under section 4 of the Protection of Children Act 1978 (c.37), discovers protected information, he shall be entitled to apply to a senior officer of the police for a disclosure notice.

(3) Where a disclosure notice has been made, the effect of that notice shall be to require an offender to make disclosure of the information in an intelligible form.

(4) A person subject to a disclosure notice under subsection (3) above shall be taken to have complied with that notice if he makes, instead, a disclosure of any key to the protected information that is in his possession.

(5) Where a person is subject to a disclosure notice under subsection (3) above and—

(a) that person is not in possession of the information,

(b) that person is incapable, without the use of a key that is not in his possession, of obtaining access to the information and of disclosing it in an intelligible form, or

(c) the disclosure notice can be complied with only by the disclosure of a key to the information.

the effect of the disclosure notice is that he shall be required to make a disclosure of the key to the protected information in his possession.

(6) Where a senior police officer is asked to make a disclosure notice under subsection (2) above he shall consider whether the protected information is likely to include indecent images of children, and shall only make a notice where he is satisfied that it is necessary to do so.

(7) Where an offender, subject to a disclosure notice, fails to meet the duty placed upon him in subsections (3) to (5) above, he is liable—

(a) on summary conviction, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum or both;

(b) on conviction on indictment, to imprisonment for a term not exceeding 7 years.

(8) In this section—

''a senior police officer'' shall mean an officer of at least the rank of superintendent.

''protected information'' has the same meaning as in section 56(1) of the Regulation of Investigatory Powers Act 2000 (c.23).

''key'' has the same meaning as in section 56(1) of the Regulation of Investigatory Powers Act 2000 (c.23).'.—[Sir Paul Beresford.]

Brought up, and read the First time.

Photo of Paul Beresford Paul Beresford Ceidwadwyr, Mole Valley

I beg to move, That the clause be read a Second time.

Photo of Roger Gale Roger Gale Ceidwadwyr, North Thanet

With this it will be convenient to discuss the following: New clause 9—Notification of requirements for relevant offenders convicted under Regulation of Investigatory Powers Act 2000

'(1) Where an offender commits an offence under section 53 of the Regulation of Investigatory Powers Act 2000 (c.23) and the court is satisfied that the protected information is likely to contain indecent images of children, then the offender shall be subject to the notification requirements under Part 2 of this Act as though he were convicted of an offence within the meaning of section 81 of this Act.

(2) In this section ''indecent images of children'' shall have the same definition as in section 7 of the Protection of Children Act 1978 (c.37).'.

New clause 10—Disqualification from working with children—

'(1) Notwithstanding the provisions of section 28 of the Criminal Justice and Court Services Act 2000 (c.43) an individual—

(a) who is convicted of any offence under Part 1 of this Act, and

(b) who receives a qualifying sentence

is, subject to subsections (2) to (4) below, disqualified from working with children.

(2) Where an individual believes that he should not be disqualified from working with children then he shall, at the time of advancing a plea of mitigation, apply to the court for a declaration that he is not disqualified.

(3) Where a court hears an application from an individual under subsection (2) above—

(a) it shall hear representation from both the individual and the prosecution, and

(b) it shall only declare a person is not disqualified to work with children if, having regard to all the circumstances, he is satisfied that the individual is unlikely to commit any further offence against a child.

(4) Where a court does declare that a person is not disqualified from working with children—

(a) it shall say in open court the reasons for making this declaration; and

(b) the provisions of subsection (1) will not apply to the individual named in the declaration.

(5) For the purposes of this section ''a qualifying sentence'' shall mean—

(a) a term of imprisonment of at least twelve months;

(b) a community rehabilitation order of twenty-four or more months duration;

(c) a community punishment order of one hundred and twenty or more hours duration;

(d) a community rehabilitation and punishment order, where the rehabilitation order component is of at least eighteen months' duration, and the punishment order component is of at least sixty hours duration.

(6) A person who is disqualified from working with children under this Act shall be disqualified from working with children for the purposes of section 28 of the Criminal Justice and Court Services Act 2000 (c.43).'.

Photo of Paul Beresford Paul Beresford Ceidwadwyr, Mole Valley

If I was at the dentist's looking at the clock, I would say ''By the skin of my teeth'', but that would be inappropriate.

Most members of the Committee will be aware of where I am coming from, particularly the Under-Secretary. I was with him when he went to New Scotland Yard and saw the team looking at encrypted video information and so on. We all heard a blast from one particular police officer who was absolutely furious because she could not untangle some encrypted information. She was pointing out something that many of us are aware of: that paedophiles collect prints, photographs and videos, and as the opportunity to use the latest technology has come in, they have moved on from videos that cannot be encrypted to digital information that can. In fact, they have gone beyond that, because many of them are using computers without any hard disc, and are storing information elsewhere.

It is exceptionally difficult for police forces to get at the information. The reasons why they want to get at that information are quite complex, but there are two basic ones. First, they want to find out who the children are. Police forces across the world are co-operating on that. When they have pictures of the children, they mix and match them to try to locate the children, so that they can get care and attention and be helped. Sometimes the police are there in time, and sometimes they are too late. Quite a number of children that I know of who have been featured in video films and who will, of course, be on the internet for ever and ever have ended up in mental hospitals; some have, ultimately, been cured.

The second reason why the police want that information is that it is an opportunity to find out whether, as new clause 8 points out, more people than just the individual who has been convicted have been

involved in a crime. It is an opportunity to trace networks of paedophiles, which are common. The first move on that was made by the Regulation of Investigatory Powers Act 2000, which went through the House with full support. The difficulty is that any individual who is convicted can get a maximum sentence of two years, but does not go on to the sex offenders list—this argument applies to new clause 9. The result is that any individual who is a paedophile will not reveal the information, as not doing so makes the sentence lesser and means that they will not go on the sex offenders list. The difficulty that police forces have is in trying to crack encrypted information; modern technology is moving exceptionally fast.

To try to get to grips with this subject, I obtained information from an expert who is one of the top people in this country working on encryption. The Government could use this gentleman's advice for information that they wanted encrypted and transferred from Department to Department—I am sure that he would be willing to help, but obviously for a fee. Fortunately, he did not charge me a fee, but pointed out that encryption has moved on rapidly. First, he stunned me by referring to information that we received from a police officer: some individuals are encrypting material by using a password system—by just picking a sentence from a book. My expert informed me that with computers of the type that the police have, it would take about two hours to break a forty-character code. However, he said that such codes and techniques are not what we should be aware of. He then started getting technical. He pointed out that we currently have a 128-bit encryption system, which is essentially unbreakable. The Romans had a 3-bit encryption system: A became C, B became D and so on. A 128-bit encryption system is therefore much more complex and impossible for straightforward computer systems to break. Even if one could, it would cost a considerable amount of money and a vast amount of time for individuals trying to break it.

To make matters worse, I understand that those who devised that system have moved on to 256-bit systems, which are even more difficult to break. To make matters even worse, those who launch themselves on the internet to find out about various changes in software find that the 128-bit system—and soon the 256-bit system—is available free to download. It is becoming simpler to operate and one can foresee the opportunity for paedophiles or anyone else who wants to use it to type two or three buttons and encrypt everything that they want to encrypt. If they are working with a machine that has access to a distant server, information can be sent off to Nigeria or wherever it is to be stored.

I think that trying to crack that situation is the wrong approach. The right approach, as set out in the amendment, is to be in a position to tell convicted sexual offenders or paedophiles that they must allow access for the police force to get at information so that the police need not spend their time trying to access it. New clauses 8 and 9 touch on that. New clause 9 is a little different because if someone is convicted of an offence under the Regulation of Investigatory Powers Act 2000—RIPA, as the police call it—and the court is

satisfied that protected information is likely to contain indecent images of children, the offender will not only be given two years but will also be on the sex offenders list.

New clause 10 tightens the existing position. In the case of conviction for paedophile activities, the individual must not be allowed to work with children. The law as it stands basically says that the court must make an order to that effect. That is particularly important in the case of an individual such as Luke Sadowski, who was a trainee teacher and clearly going into that career for his hobby, if I may use that unfortunate phrase. But the court forgot—the prosecutor forgot—to ask that that particular ban should take effect. The whole point of new clause 10 is to ensure that that is automatic. Because that would be automatic I have also included an escape section so that in a case where an offender feels that he or she has good reason not to be caught by that automatic provision, they may apply to the court to have it set aside or reversed. The prosecution will be able to oppose that if they wish, as the clause sets out. If the court agrees to set that automatic provision to one side, it must give the reasons.

Photo of Dominic Grieve Dominic Grieve Ceidwadwyr, Beaconsfield 6:00, 14 Hydref 2003

I am extremely grateful to my hon. Friend for introducing the new clauses. As he knows, I have in the past worked on the subject matter of new clause 8, encryption, with his assistance. I am wholly persuaded that we need to introduce legislation to deal with the problem of encryption and to provide a penalty commensurate with the gravity of the offence being investigated for those who refuse to provide the encryption key. It is a deplorable state of affairs that there could be reasonable suspicion that someone has downloaded pornographic and indecent images of children and they could be confronted with an investigation, but that because the police are unable to break the encryption, that person knows that he will receive a relatively short sentence as long as he refuses to co-operate, whereas he would be likely to receive a more substantial sentence if the information were obtained from his computer. That has always inclined me to the view that we must do something about encryption, which is what new clause 8 achieves. I hope that the Minister will respond to it positively.

New clause 9 follows logically from new clause 8. My hon. Friend was also right about new clause 10. The particular case that he cited illustrates how unfortunate it is that one has to have a court order or nothing can be done subsequently. Introducing an automatic provision that an offender cannot work with children following a conviction would close that loophole. That, too, appears to merit a favourable response from the Government.

I appreciate that the Government may wish to go away and consider that further but I hope that on such important matters they can take on board my hon. Friend's points and respond positively.

Photo of Paul Goggins Paul Goggins Parliamentary Under-Secretary, Home Office

I well remember the visit to the Metropolitan police to which the hon. Member for Mole Valley referred. Two things stand out in my mind as I think back to it. One is the complexity of the task that those officers have in an ever-changing world of technology and deviousness on the part of the

people who operate with those systems for the purposes of child pornography and child abuse. The second is the enormous dedication of the people who, day in, day out, year in, year out, do a job on our behalf that none of us would ever want to have to do. I pay tribute to them for that.

It is clear from that visit, from the various discussions that we have had and from his speech to the Committee that the hon. Gentleman understands the complexity of those issues very well. We have much to learn from him. I am delighted that he is a member of the taskforce that I chair—his contribution to it is welcome. Although I shall mostly resist his amendments, I hope that he will not think that I do not take the issues he raised as seriously as he does. I understand why he tabled the new clauses.

New clause 8 would use the threat of an extended term of imprisonment as an encouragement to an offender to disclose electronic information that they have protected. The hon. Gentleman has already indicated that when it is implemented, part III of RIPA will provide a power to compel the disclosure of protected information. Having said that, I recognise that there is a concern, which is reinforced by what the hon. Member for Beaconsfield said, that as the criminal use of encryption becomes more widespread and people become more proficient, some offenders might choose to accept a two-year term of imprisonment rather than disclose the full horrors of their data and open themselves up to much longer terms of imprisonment. However, for there to be a seven-year term of imprisonment for failing to produce a password, without any other form of offending, is perhaps not proportionate. Perhaps the hon. Member for Mole Valley will reflect on that.

I want to consider further the suggestion that where a conviction for a schedule 3 offence is secured, where the police have recovered protected information during the investigation and where the offender has failed to comply with the disclosure requirement under RIPA, the court should be able when sentencing to draw an inference about the data that the offender is seeking to protect—even on conviction. I hope that that gives some encouragement to the hon. Gentleman in the context of the implementation of RIPA. The drafting of the clause does not catch the right balance.

I understand entirely the objective that gave rise to new clause 9. However, I do not accept that it is appropriate or consistent with a notification under part 2 for offenders who have failed to comply with the requirement under section 53 of RIPA to face sex offender registration at the discretion of the court. We have on several occasions talked about sex offender registration being an automatic requirement following conviction for a sexual offence. The notification requirements are not in themselves a punishment—they are part of an administrative procedure. To include in the register people convicted only of failing to comply with a requirement to disclose protected information could seriously undermine its credibility.

New clause 10 would introduce a provision to disqualify from working with children any person who is convicted of an offence in part 1 and receives one of the qualifying sentences. I share the hon. Gentleman's

desire to provide maximum protection for children. That has been the central task of the Committee and we have had a fair consensus on it throughout our deliberations. Although the new clause is not required and I do not see how it can be justified, I want to reflect on the issues he raises.

To extend the scheme to those who commit offences against an adult only would bring within its scope some cases where there is no evidence of a risk to children. As heinous as all of those crimes may be, someone who has committed a sexual crime against an adult may not be a risk to children. I want to reflect further on that.

We must take account of the severity of the disqualification scheme. It provides a lifetime ban on all work with children, even helping out with one's own children in a local sports activity, or another young person's activity. It is a serious thing for a lifetime ban of that kind to be implemented. We want protection, but we also want a system that works. I think that we are all pleased with the level of compliance that we have achieved through the register to date. I am grateful to the hon. Gentleman for pressing us hard on the issue. I am sure that he will continue to do so. I hope he feels that he is making some progress and that, in that spirit, he will withdraw his amendment.

Photo of Paul Beresford Paul Beresford Ceidwadwyr, Mole Valley

That reply was a little disappointing, but not too surprising. New clause 9 was pushing the boundaries quite hard. However, what the Under-Secretary said about new clause 8 was a little bit flawed. The wording at the beginning makes it clear that it would apply only to someone who has already been convicted of an offence involving indecent activities against children—paedophile activity is perhaps the best way of putting it. I shall reflect on what he said and may possibly return to it on Report.

I will reflect on the Under-Secretary's points about new clause 9. They have some validity.

I was a little surprised by the Minister's reaction to new clause 10. I used Luke Sadowski as an example. Once he comes out of prison Luke Sadowski is technically free to work with children because someone forgot. Putting the boot on the other foot and turning the matter around offers an opportunity, which could perhaps become standard practice for the defence on behalf of the convicted individual, to appeal against the automatic requirement not to work with children. I do not know how many other individuals like Luke Sadowski, who would quite clearly be dangerous to children, have slipped through the net because someone forgot.

I want to go away and think about this again. As a Labour Back Bencher said, this is a unique opportunity because it is a unique Bill. If we miss the opportunity we will miss it for half a lifetime. I hope that the Minister will look at this seriously and find a way to get a change along these lines because at

the end of the day we are helping battered, abused children. I beg to ask leave to withdraw the motion.

Motion and clause, by leave, withdrawn.