PC Probe: Your laptop isn't safe from the police's prying eyes

 

Gallery

Posted on 30 Jul 2007 at 10:18

If the police raided your home and demanded access to your hard drive they'd normally need a warrant, but beyond your four walls it's open season on your data.

A recent US case in which Customs officials rifled through a teacher's laptop has highlighted that authorities have a different view of laptop data privacy than their citizens.

"Our laptop computers contain vast amounts of personal information about our lives. You may do your banking on your computer or send email to your doctor about health concerns," says Electronic Freedom Frontier lawyer Lee Tien. "Travellers shouldn't be subjected to unconstitutionally invasive searches of their laptops and other electronic devices just because they're crossing the border."

The case continues in the US, but, while Americans potentially have the Constitution to protect their rights, Britons have no such safety net. Both Customs and police could force you to turn over your laptop at the merest hint of suspicion. "If you're coming through Customs there's a very broad range of powers, and they can examine any material entering the country," says Emet Clafe, a director with the human rights organisation Liberty. "If we allow access to books and other written material then you'd have to give them access to data, and you shouldn't expect any privacy."

While Customs appears to have carte blanche, what about the police's new "stop-and-search" powers? "If you were stopped under terror powers then they should need additional authority to inspect your computer, because data within a laptop is outside the scope of the search," says Clafe. "And material on a computer could be privileged, such as messages to and from a lawyer."

The Home Office, however, claims stop-and-search rights depend on the alleged crime. "Your right to privacy depends on what the police think you've been doing," claims a Home Office spokesperson. "It's a movable feast and their level of powers depends on each case."

That explanation may suit the Home Office, but the vague UK law could breach European legislation. "Stop-and-search powers for computers is problematic," argues Yaman Akdeniz, founder of Cyber-Rights & Cyber-Liberties UK. "Mere suspicion shouldn't turn into intrusive searches of laptops."

"The European Court of Human Rights has warned several times that member states should be 'particularly vigilant where the authorities are empowered to order and effect searches without a judicial warrant'. UK powers seem to fall short of this requirement if applied to searching laptops for information."

Encrypting data

The obvious solution for anyone worried about police officers rifling through their data is to encrypt files, but this could lead to more serious repercussions - even imprisonment. Politicians are keen to push through the controversial Part III of the Regulation of Investigatory Powers Act (RIPA), which could demand data decryption. "There's currently no obligation to decrypt," says Richard Carter, resident security expert at Cambridge University. "There are provisions for this in RIPA, but they've never been brought into force, mainly because there were flaws that the City of London campaigned against.

"While there's agreement that terrorists or paedophiles should be forced to decrypt files, those laws could also be applied to major banks that use encryption to protect financial data. The problem is coming up with laws that target only bad people."

Worse still, making failure to provide encryption keys a criminal offence could let genuine threats to society off the hook. "If you arrest a paedophile or terrorist and say 'Decrypt this or I'll lock you up for two years,' he'll take the two years, because you'd be able to lock them up for 30 years if the evidence on that computer was made available," says Carter.