Do I have to give the police my phone password?

Part III of the Regulation of Investigatory Powers Act 2000 (“the Act”) enables public authorities i.e. the police, the National Crime Agency and HMRC among many; to require access to protected electronic information. This can only be done when a person has been granted the appropriate permission by a circuit judge or district judge if in the magistrates’ court.

Technologies used to protect electronic data and maintain the privacy of electronic communications may be used by individuals to conceal evidence of unlawful conduct and for the purpose of evading detection or prosecution. It is for this reason that Part III of the Act was introduced to allow members of law enforcement to lawfully obtain, in an intelligible form, such protected information and to acquire the means to gain access to it.

Since coming in to force in October 2007, the use of the powers provided in the statutory framework have been on the rise. Public authorities are increasingly showing a willingness to exercise the rights granted by Part III of the Act in an effort to obtain access to devices in all manner of cases. Ostensibly, it was introduced to take account of societies significant technological changes such as stronger encryption methods and the growth of the Internet.

What is the law on providing passwords for electronic devices?

Section 49 of the Act is the relevant section which allows permitted authorities to demand passwords or pin codes in order to access laptops, phones and other electronic devices. It enables the police, for example, to issue notices which require the disclosure of protected or encrypted information that would facilitate the obtaining or discovery of a ‘key’. A ‘key’ is defined for the purposes of the Act as “any key, code, password, algorithm or other data, the use of which allows access to electronic data, or facilitates the putting of the data into an intelligible form.”

Should an individual refuse to provide access to such data, they could risk committing a criminal offence and facing time in custody. Refusal to comply with a notice as detailed above could result in a maximum sentence of two years’ imprisonment; or five years should the case involve issues of national security or child indecency (see section 53 of the Act which creates an offence of failing to comply with the terms of a notice served under section 49).

Section 53(2) does however provide a defence as follows; if a person can show that they were not in possession of the required key before the relevant notice was issued, then that person shall be found not guilty of an offence.

Public authorities are able to request disclosure of the type of information described above if it is necessary in the interests of national security; for the purpose of preventing or detecting crime; or in the interests of the economic well-being of the United Kingdom. The notice itself must also meet certain criteria, for example; it must be given in writing, describe the protected information to which it relates and specify the office, rank or position held by the person giving it.

The procedure for requesting passwords for electronic devices

Criminal investigations into alleged offences are usually conducted by the police. In many cases, these investigations will involve the analysis of electronic devices which could include looking at social media accounts, accessing call history and messages and viewing photos and videos. This could be particularly necessary in cases involving serious sexual offences, indecent images, terrorism and money laundering.

Regarding requests for protected information, the police may make an initial request for a password to be provided by the suspect during interview at the police station. This will be done without serving an authorised section 49 notice and will usually be in the early stages of the investigation. There is no legal obligation for a password to be provided at this stage, and in many cases it may be advisable not to do so.

Following this, the police may serve a section 49 notice on the suspect requiring disclosure of the relevant protected information. It is at this point that the suspect must consider whether to comply with the notice or not due to the potential repercussions which could follow.

What are the implications of not providing passwords to the police?

It is important for the suspect to be advised as to the consequences of refusing to provide the information requested under a section 49 notice. Doing so could result in them committing a criminal offence and facing prosecution with a potential custodial sentence.

The suspect will however have various factors to consider before deciding whether or not to comply with the notice. They may wish to think about whether there is any material on their devices which would implicate them in an offence or suggest any level of involvement, even if this is not the case. In any event, there is a balance to be struck between considering the risk of being prosecuted for failure to disclose the requested password, against whether any evidence found as a consequence of disclosing the password would further implicate a suspect in the offence for which they are being investigated.

If a suspect is being investigated for a serious offence carrying a significant sentence, they may wish to refuse to provide their passwords should the risk of implicating themselves be high. Seeking legal advice at this stage in the process is recommended as a solicitor will be able to give the appropriate advice. However, it is ultimately the suspects decision as to whether they wish to comply with the section 49 notice.

Should suspects have to give passwords?

Although the law under Part III of the Act was originally used as a counter-terrorism measure, it is now being applied on a much wider basis. Potential controversy lies in the fact that the application of the law under Part III could lead to disproportionate results. For example, a suspect could be imprisoned for failing to provide their password but not for the crime they were originally investigated for should they not be charged or found not guilty at trial.

The measure under section 49 has also been criticized as a method of eroding privacy resulting in a suspect being forced to incriminate themselves. It may be that the suspect cannot remember requested passwords, or purports to not remember as such, implicating further issues for the court to address.

Prosecutions for failing to disclose passwords

Between 2014 and 2015, a total of 37 section 49 notices were served which resulted in only 3 convictions. In 2016, a man was sentenced to 8 months’ imprisonment for refusing to disclose the passwords to his iPhone and iPad. A year later in September 2017, another man was sentenced to 36 weeks’ imprisonment for failing to give the police the password to his iPad. Then, in 2018, a suspect in a murder investigation was imprisoned for 14 months’ having failed to provide his Facebook password. This was seen to have obstructed the police’s investigation and caused significant delay to an already difficult task for the police to oversee.

How Olliers can help

The threat of a section 49 notice being served can happen early on in a criminal investigation. It is important to seek legal advice should you receive a notice or the threat of one. Should you have any concerns about the imposition of a section 49 notice, please contact our team and we can arrange a confidential discussion as to how Olliers can assist you at this time.