Recently at Southampton Crown Court, Stephen Nicholson, a suspect in a murder investigation, pleaded guilty to a charge under the Regulation of Investigatory Powers Act (RIPA). It was alleged that he had failed to provide his Facebook password which obstructed the police in their investigations. So does a suspect have to provide their password for Facebook, Instagram, Snapchat or any other social media to police? And if so why?
Whilst a suspect is detained at the police station, the police will be conducting enquiries into the alleged offence. In a vast number of cases this will include looking at a suspect’s social media accounts particularly when dealing with serious sexual or violent offences. If these accounts, mobile phones or laptops are password protected then the police will usually serve a RIPA notice on the suspect requesting they provide the password sought. So should the suspect comply with that request?
Section 49 introduces a power to enable members of the law enforcement to give notices that require the disclosure of protected or encrypted information that would facilitate the obtaining or discovery of the “key”. A key is defined for the purposes of the Act as any key, code, password, algorithm or other data that allows access to the electronic data or facilitates the putting of the data in an intelligible form.
The grounds for a section 49 notice are:
(a) that the key is in the possession of the person on whom the notice is served; (b) disclosure is necessary for: (i) national security; (ii) preventing or detecting crime; (iii) economic well-being of the United Kingdom; or (iv) securing performance by any public authority of a statutory power or duty; (c)
the disclosure requirement is proportionate to what is sought to be achieved; and (d) an intelligible version of the relevant protected information cannot be obtained by other reasonable means.
Section 53 creates an offence of failing to comply with the terms of a notice served under section 49.
Subsection (2) provides a defence if a person can show that he was not in possession of a key at a particular time. However, the onus is on that person to produce sufficient evidence in support and not for the contrary position to be proved beyond reasonable doubt.
The suspect must be advised of the consequences of not providing the key/password requested and advised that by refusing to do so they would be committing a criminal offence.
However, there will be various factors that a suspect may want to consider before they disclose a password, such as whether any material that could be accessed would implicate them in an offence, or suggest that they were involved when possibly they were not. As a consequence a suspect must weigh the risk of being prosecuted for failure to disclose the requested password against whether any evidence found as a consequence of disclosing the password would further implicate them in the offence being investigated.
For example, if the case involves a serious offence that attracts a significant sentence then he/she may not wish to provide the key/password if by doing so they would implicate their involvement in the offence. The decision is for the suspect and a solicitor must not advise him to commit an offence, but simply explain the consequences of non-compliance.
There are clearly implications for a suspect not providing requested passwords which need to be considered very carefully based on the circumstances of each case. Of course the police may be able to access the material that is password protected in due course through their own investigations without the key/password and the suspect may still face prosecution for the substantive offence.
If you face an investigation for a serious offence and have been served with a notice under RIPA please do not hesitate to contact the Public Defender Service regarding this complex area of law. We have solicitors, barristers and Queen’s Counsel who are experienced in dealing with cases of this nature and providing the appropriate advice.