« RULES ON GIVING OF NOTICE paras 4.1 to 4.5 | Main | Obtaining appropriate permission paras 4.9 to 4.10 »

Application for appropriate permission paras 4.6 to 4.8

Application for appropriate permission

4.6 Applications for appropriate permission must be made in writing or electronically to a person able to give appropriate permission. The person making the application will be a person involved in conducting an investigation or operation for a public authority. The applicant may be an individual who is seeking appropriate permission or is seeking the grant of appropriate permission on behalf of another person.

4.7 Applications may be made orally in exceptional circumstances but a record of that application must be made in writing or electronically as soon as possible.

4.8 Applications - the original or a copy of which must be retained by the person with the appropriate permission - must:

  • include the name (or designation)[10] and the office, rank or position held by the person making the application;

        • [10] The use of a designation rather than a name will be appropriate only for persons in one of the Intelligence services.

  • where it is different from the applicant, the name (or designation) and the office, rank or position held by the person for whom appropriate permission is being sought;
  • include the operation name (if applicable) to which the application relates;
  • specify the grounds on which the imposition of a disclosure requirement is necessary whether:

    • in the interests of national security;
    • for the purpose of preventing or detecting crime;
    • in the interests of the economic well-being of the United Kingdom; or
    • for the purpose of securing the effective exercise or proper performance by any public authority of any statutory power or statutory duty (and must identify that power or duty);

  • describe the protected information which has been, or is likely to be, lawfully obtained;
  • confirm the statutory power or other lawful means in which the protected information has been, or is likely to be, lawfully obtained;
  • explain why it is reasonably believed that the person on whom it is intended to serve a section 49 notice has possession of a key or keys to the protected information described in the application;
  • explain why the imposition of a disclosure requirement is considered necessary and proportionate to what is sought to be achieved by its imposition;
  • consider and, where appropriate, describe any meaningful collateral intrusion
  • the extent to which the privacy of any individual not under investigation may be infringed and why that intrusion is justified in the circumstances;
  • explain why it is not reasonably practicable to acquire or obtain access to the protected information in an intelligible form by some other method without serving a section 49 notice;
  • identify and explain any urgency with which the proposed disclosure requirement is necessary.


This Code of Practice does not clearly specify who exactly is permitted to claim that a Disclosure Notice is "in the interests of national security".

It would be far better if only investigators actually conducting a "National Security Investigation" i.e. members of the intelligence agencies listed under the Intelligence Services Act 1984 - the Secret Intelligence Service MI6 and GCHQ, or under the Security Service Act 1989 - the Security Service MI5, and designated anti-terrorism units of the Police e.g. the Metroplitan Police Anti-Terrorist Branch S013 and perhaps Special Branch, are permitted to make this claim.

This is important because the maximum criminal penalty for a refusal of a Disclosure Notice has been increased from 2 years to 5 years in prison, under RIPA section 53, as amended by the Terrorism Act 2006 section 15 Maximum penalty for contravening notice relating to encrypted information

The Code of Practice must forbid the abuse of the term "national security" by any other "normal" police forces or any other public authorities and bureaucrats who may happen to be authorised to demand a Cryptographic Key or Plaintext.

The oranisations who should notnot have a remit to investigate "national security" cases on their own, even though their intelligence analysis or investigations of "normal" or even "serious" crimes may, on rare occaisions, lead them towards a terrorist or espionage conspiracy, ahead of any other agency or department.

If anybody else, apart from MI5, MI6, GCHQ or the Police anti-terrorism units is claiming to be part of a "national security investigation", without close liason with one of these proper investigative agencies , then they themselves are probably actually endangering national security.

What exactly is the definition of

in the interests of the economic well-being of the United Kingdom

The Intelligence and Security
Annual Report 2005–2006
(.pdf) says:


97. In its 2004–2005 Annual Report, the Committee expressed concern that the
requirements and priorities for intelligence collection in relation to safeguarding the
economic well-being of the UK were unclear, and that there was no common definition of what constituted 'economic well-being' across Whitehall.

We took evidence from the Foreign Secretary on this matter. He reported that, largely in
response to the concerns of the Committee, the economic well-being requirements
had been reviewed in detail as part of the annual exercise to update the JIC’s
requirements and priorities, and a clearer definition of the UK’s requirements for intelligence in respect of economic well-being has been developed.

We also raised the matter with Sir Richard Mottram, who told us that:

"The important point is to have a shared understanding [of economic well-being]
between the policy people and the intelligence people. The way to do that is to
detail what aspects the policy people are interested in… In relation to energy; you
will have a set of requirements which you specify. In relation to financial services,
you will have a set of interests that you specify… and then the intelligence people
and the assessment people then focus on those things. To have a… definition of
economic well-being I do not think adds much to the sum total in relation to this

So what exactly is the Home Office policy definition of "economic well-being" with respect to Cryptographic Key Disclosure Notices ?

Surely this Code of Practice should spell this out, in broad terms at least ?

Multiple Disclosure Notices or applications ?

The Code of Practice gives no guidance on Multiple Disclosure Notice applications.

  • Is a separate Disclosure Notice required for each encrypted file on a suspect hard disk ?

  • What if there are multiple files, each with a different single Cryptographic Key or even each with multiple Cryptographic Keys ?

Comparison should be made with the RIPA Part ! Chapter 2 consultation,

GENERAL EXTENT OF POWERS paras 2.1 to 2.11

Footnote [11] clearly applies the principle that "national security investigations" are distinct from "normal" or even "serious" criminal invedtigations by other law enforcement agencies or departments of state.

[11] One of the functions of the Security Service is the protection of national security and in particular the protection against threats from terrorism. These functions extend throughout the United Kingdom, except in Northern Ireland where the lead responsibility for investigating the threat from terrorism related to the affairs of Northern Ireland lies with the Police Service of Northern Ireland. A designated person in another public authority should not grant an authorisation or give a notice under the Act where the operation or investigation falls within the responsibilities of the Security Service, as set out above, except where the conduct is to be undertaken by a Special Branch, by the Metropolitan Police Counter Terrorism Command, or where the Security Service has agreed that another public authority can acquire communications data in relation to an operation or investigation which would fall within the responsibilities of the Security Service.

What holds for the "national security investigation" aspects of the collection of Communications Traffic Data should also, surely, apply to the RIPA Part III Disclosure Notices as well ?

Post a comment