The government today announced plans for a new Communications Data Bill

The purpose of the Bill is to: allow communications data capabilities for the prevention and detection of crime and protection of national security to keep up with changing technology through providing for the collection and retention of such data, including data not required for the business purposes of communications service providers; and to ensure strict safeguards continue to strike the proper balance between privacy and protecting the public.

The main elements of the Bill are:

• Modify the procedures for acquiring communications data and allow
  this data to be retained;
• Transpose EU Directive 2006/24/EC on the retention of communications data into UK law.

LINX members who were present at LINX 60 will recognise this as legislation supporting the new plans described in the presentation by Home Office officials.

The Home Office has disclosed police use of powers to demand the decryption of data or production of decryption keys. The powers, created as s53 of the Regulation of Investigatory Powers Act 2000 (RIPA), came into force on 1st October 2007. Since that date eight notices have been served, which with the following results:

• Compliance by recipient of notice, on two occasions;

• Refusal to comply and prosecution, on two occasions;
• Refusal to comply, and the authorities are still considering whether to prosecute, on two occasions;
• No information from the Home Office statement, the remaining two occasions.

None of these cases has yet come to court.

The Home Secretary stated that the four cases where the suspect refused to comply were in terrorism-related investigations; the Register reports that the other four cases were investigations for conspiracy to murder; withholding information in relation to conspiracy to murder; conspiracy to defraud; and making indecent images of children.

The Nominet election results are in. Gordon Dick was re-elected to Nominet’s Council of Management (now to be known as its Board of Directors), and is joined by Jim Davies. Davies was one of the candidates urging members to reject Special Resolution 6, which would have empowered the Board to appoint two directors.

In a blow for Chairman Bob Gilbert, Special Resolution 6 did not receive the 75% of votes cast necessary to pass. All the other, less controversial, constitutional changes were passed overwhelmingly.

Over 60% of votes available were cast, but due to Nominet’s weighted voting system these are held by less than 16% of the electorate.

Online music innovators We7 have signed a deal with their first major record label, SonyBMG, to distribute Sony’s entire music catalogue without charge in DRM-free MP3 format. It’s high-quality too: the bitrate is 192kbps.

We7’s completely legal, licensed service is funded by advertising. Each downloaded - or, if you prefer, streamed - track is preceded by an advert. 28 days later users can swap the advertising encumbered version for an ad-free track, for up to 20 tracks per month without charge. Additional tracks cost 20p each.

We7 has already signed a number of independent labels, but its success will likely depend on convincing the other major labels - EMI, Warner Music and the ever-recalcitrant Universal - that it’s better to embrace innovation than to cling to outdated business models and litigation. Internet users and ISPs will be cheering them on.

Snippets as they are said:

• According to Nominet Chairman Bob Gilbert, will bid to run the registry for .eu when the current contract comes up for re-tender. The current contract is held by EurID
• Lesley Cowley, CEO, said that with the regretable lack of involvement in Nominet’s governance from most of its membership it was now in question whether the current membership structure was “fit for purpose”.

Nicholas Bohm of the Foundation for Information Policy Research (FIPR) has written in with further comments on the legality of Phorm:

Dear Malcolm

I’ve only belatedly noticed your remarks of 14th March, and in particular the final paragraph:

“Regardless of the legal debate, it is highly significant that the government has decided that as a matter of public policy RIPA should not stand in the way of Phorm and similar services, provided user consent is obtained through the ISP’s Terms and Conditions of Service. This implies that even if the legal arguments remain contested, ISP prosecution is unlikely and the government might contemplate legislative reform to clarify the legal situation in favour of Phorm and their ISP partners.”

I expect you’ve followed the subsequent publication of FIPR’s communications with the Information Commissioner and the Home Office, and in particular Richard Clayton’s technical analysis and my legal analysis.

You will obviously reach your own conclusions about what position LINX should take in all this, and the only point I wanted to pick up from your own remarks is the suggestion that user consent can be obtained through the ISP’s Terms and Conditions of Service.

One of the things on which FIPR and the ICO agree (and on which the Home Office takes no position) is that the Privacy and Electronic Communications (EC Directive) Regulations 2003 impose a requirement for user consent. (The ICO’s position is stated here, and my analysis is at paragraphs 55 to 58 of my paper.)

My point to you (from para 57 of my paper) is that the necessary consent is “any freely given specific and informed indication of his wishes by which the data subject signifies his agreement.” The data subject may be any user of a machine, not only the subscriber, and the distinction between the two is clearly drawn in the PECR definitions and in the Directive which it implements.

This means that getting consent from a subscriber will not be enough to get consent from other users. No doubt for some purposes it is possible for terms and conditions to oblige a subscriber to promise that he or she is authorised to act on behalf of all other users, but this cannot ensure that the subscriber really has that authority. If not, the consent of the other users has not been given, and the ISP cannot get off the hook by blaming the subscriber.

Even if an ISP is entitled under its applicable terms to change those terms, exercising the power to do so by including a consent under PECR does not in fact amount to obtaining “freely given specific and informed indication of his wishes by which the data subject signifies his agreement.”

I think that ISPs will need to be wary of what amounts to true consent in this context.

Kind regards,

Nick

Nominet, the domain name registry that runs .uk, has written to its membership campaigning against three of the candidates for positions on its Board.

Nominet’s letter claims a distribution of profits to members, as some of its members want, would be unlawful under its Articles, and urges members to support a Special Resolution that would allow the Board to appoint two “independent” directors, whose continued office would be subject to ratification at an AGM. Nominet’s web site goes so far as to invite members who have already voted to change their vote.

The three controversial candidates are Robert Fox, Jim Davies and Darren Brown. Although during this contest they have been described collectively as “domainers” (speculative domain registrants), Darren Brown has written to LINX to point out that he is not a domainer but a normal ISP. Mr Brown also says that although he remains opposed to Special Resolution 6 he potentially supportive of Nominet’s donating money to charity.

The legal advice, which Nominet has published in full, notes that Nominet could potentially be be operated at a loss lawfully, by reducing registration prices for future registrations, although this would be risky if the loss imperilled Nominet’s future success. This is the method LINX, another not-for-profit Internet organisation, sometimes employs to prevent surpluses accruing excessively. The legal advice is remarkably unequivocal that other methods of distributing funds would be unlawful, with the sole exception of donating funds to charity, as the current Board proposes.

Nominet’s letter invites candidates to disclose more fully previous times they have stood for election, and details of legal actions in which they have been involved. The Register’s report draws out the significance of these demands, reporting that one candidate, Robert Fox, previously stood for election proposing to turn Nominet into a commercial, for-profit company and another, Jim Davies, was heavily criticised by the judge in a High Court case he lost in 2005, who called him an “opportunist” whose evidence was “palpable nonsense”.

The election continues until 30th April. Just as striking and potentially as important for the long term is the statement in the Board’s letter that

Our structures were originally created on the assumption that there would be active member involvement in Nominet. These structures, when combined with the current low levels of member voting, make us vulnerable to capture both at Board and PAB level, by those with interests that, in our view, conflict with those of Nominet, our members and our wider stakeholder group. [emphasis added]

Nominet CEO Lesley Cowley is quoted by the Register repeating this warning. This raises questions for the future: have the Board (and CEO) lost confidence in the membership model altogether? Do they think it can be sustained, but only with more safeguards and constraints, and if so, how does that fit with recent moves to give greater discretion to the Board in the Articles? Do they think the new process for appointed Directors will solve this problem, or can we expect to hear that this experience has uncovered a need for further constitutional changes? These questions will remain once the election dust has settled.

Note:This article was originally published at 10:55am and revised at 13:12pm and 14:10 following discussion with Nominet.
UpdateThis article was edited on 25th April at 10:40am to reflect communications received by LINX from Mr Brown.