[Portly_Giraffe]

Here is my commentary based on my further entirely personal interpretation of the exchange with the Home Office. Before I start I should say I found Simon and Andrew very helpful and responsive, and keen to say as much as they reasonably could given the situation. In my view they have said all they can and need to say on these points, and we should now move the campaign on from them.

The commentary below sets out my initial thoughts. They are entirely my opinions, and others involved in the exchange may have differing views.

Points 1 and 2 confirm that RIPA applies to anyone, which could include ISPs and their suppliers.

Point 3 says that we should not be chasing the Home Office for enforcement of RIPA following the BT Trials in 2006 and 2007. I think it is the Attorney General we should be focusing on. We might want to write polite letters to her to ask why, when there is a widespread conviction that the law has been broken, no action appears to have been taken.

Lady Scotland of Asthal
20 Victoria Street
London SW1H 0NF

Point 4 undermines BT’s “it was only a technical trial” argument. It doesn’t matter what you do or intend to do with the data, it is the interception itself which is the offence under RIPA.

Point 5 was intended to cover the position of opted-out users of a Phorm ISP. Under RIPA it is not certain either way whether intercepting traffic to determine whether there is consent to intercept it is illegal. BT could argue that it is lawful because the interception is part of a traffic management process (determining whether or not to divert the traffic for Phorm processing). We could argue that operating a Phorm/Webwise service is a commercial decision of theirs and that without it the need for such traffic management would not arise. Any thoughts on this from Alexander would be useful. If Phorm goes ahead I expect this will be argued in Court sooner or later.

In my view, Point 6 says that the CPS has the basis for a case against BT under RIPA, but there will be other aspects of the situation which apply and will have to be argued.

Point 7 confirms that the Home Office has said nothing about the interception of secure browsing in their comments on RIPA. I do not think we need to take this further right now as I do not think there would be any question that the interception of secure browsing is illegal under several laws.

Point 8 says that it is not certain either way under RIPA whether website owners’ consent to interception of open web traffic can be taken as implied. The key phrase here is “it may be argued”. Another interesting point is that law distinguishes the inbound message from the outbound message (RIPA 3(1)(b) as opposed to 3(1)(a)). And other laws may also make the use of the intercepted data illegal. Again, any thoughts on this from Alexander would be useful. And again, if Phorm goes ahead I expect this will be argued in Court sooner or later.

Point 9 reaffirms that if there are adequate safeguards in place (informed opt-in, privacy) then targeted online advertising is a legitimate activity for an ISP under RIPA. We can argue this case on many levels: from a legal perspective is opt-in really informed and are privacy safeguards sufficient? And which other laws may apply? From a practical perspective is the equipment used safe from criminals? From a political perspective, should ISPs be allowed to operate this kind of service at all?

Point 10 emphasises that the decision to opt in must be informed. We should keep track of the trial and any other proposed Phorm activity: if the fact that the service involves the interception, reading and processing of almost all the user’s web traffic is not made as clear as the purported benefits, then in my opinion there would be a case that any subsequent interceptions would be illegal under RIPA.