Digital search and seizure

There's a grey area around police powers to compel intermediaries such as ISPs to hand over digital evidence. In both Ireland and the UK, though, the issue seldom arises because most ISPs seem to be happy to give voluntary cooperation, avoiding the need for the police to rely on their compulsory powers. However, this strategy falls down when an intermediary decides not to play ball, and the seizure of Bristol Indymedia servers illustrates the problems that result.

An Indymedia press release gives the background:

On Mon 20th June, Bristol Indymedia (IMC Bristol) received an email from the police asking to contact them with reference to a posting on the IMC Bristol newswire. IMC Bristol volunteers appointed a solicitor and started briefing them to contact the police on their behalf. On Tue 21st June, the police contacted an IMC Bristol volunteer asking for IP logs. The subject of the police enquiry was a posting claiming that damage had been done to either some cars on a train transport, the transport itself, or the railway line.

Bristol Indymedia volunteers hid the post (originally posted late in the evening of 17th June) from their main newswire within 24 hours of it being posted - as it violated IMC Bristol editorial policy - and well before the police made initial contact.

When the solicitor contacted CID on the 21st to inform them that they could not have the server, or access to it, the police said that they could go through data protection and legal moves to get the logs or get a search warrant, and that they may arrest somebody for obstructing the course of justice.

At this point, an IMC Bristol volunteer informed IMC UK about the events. IMC Bristol then contacted Liberty, whose legal advisor contacted the police to press them on the issue that this server was considered an item of journalistic equipment and so subject to special provision under the law. The police have yet to confirm this. NUJ and Privacy International have also been contacted.

As of 24th June 2005, IMC Bristol remain in possession of their server. Communications with the police, and between various legal and civil rights organisations continue while technical and legal issues surrounding the case are clarified. Bristol Indymedia is an independent news service. As part of our policy, we will not make non-public information we hold publicly available. We do not permanently store IP addresses. We do not intend to voluntarily hand over information to the police as they have requested, and have informed them of this.

The police response came shortly afterwards and on June 27th the server was seized. From the Register:

Police seized a server used by Indymedia, the independent newsgathering collective, from the Bristol home of a member of the group after issuing a search warrant on Monday. The raid is the second time within the last year that an Indymedia server has been seized in the UK.

Officers also took the unnamed Bristol collective member in for questioning, and seized a PC, in an incident that has already provoked a huge row. The action happened despite the intervention on Indymedia's behalf by justice group Liberty whose lawyers advised police that the server was "considered an item of journalistic equipment and so subject to special provision under the law".

Despite this reference to a person being "taken in for questioning" later reports indicate that the owner of the server has in fact been charged with incitement to criminal damage. Analysis and insightful comment at Spy Blog which points out that:

It is not unheard of for malicious people to post something illegal or controversial to an open discussion forum and then to complain to the authorities that the administrators of the discussion forum are doing something illegal [...] For the British Transport Police or any other UK Police force to ignore the National High Tech Crime Unit's guidlines on "minimal disruption" to multi-user networked computers during legal evidence gathering or investigations, is a disproportionate abuse of power [...] There is no justification for the "collateral damage" caused by the seizure of an onlime server in order to attempt to identify the IP address of a single poster.

It's hard to understand why the owner of the server was arrested, but this comment from Spy Blog seems about right:

Initially the Bristol IMC volunteer was a potential witness, either to incitement to criminal damage (the offending item argued that damaging cars was legitamate political protest), or to the statement made by the poster that they had committed the damage. Now the volunteer is a suspect. Maybe the BTP [British Transport Police] allege that the suspect incited criminal damage by failing to delete (it was hidden from the newswire but not deleted) the offending post when it came to their attention. Or maybe the arrest was an act of spite when Bristol IMC quite reasonably told the police to go away and get a warrant.

London Freelance discusses the journalistic privilege issues:

When the police contacted them. BIM called the NUJ and civil liberties organisation Liberty, who argued that demanding information from Indymedia requires a special warrant to obtain journalistic material under the Police and Criminal Evidence Act 1984. Asked about this, a British Transport Police spokesperson said "A warrant was obtained; I don't know the details. ... Website server - I don't know if you could describe it as journalistic material?" They later clarified that "We obtained a Section 8 [PACE] Warrant after discussing with the Crown Prosecution Service who said we didn't need a Section 9 / Schedule 1 [journalistic material] warrant." Section 8 warrants cover evidence-gathering except where privileged, excluded (that is, confidential or medical) or "special procedure" (that is, other journalistic) material is involved.

Two brief comments. First, there is a specific English law (the Regulation of Investigatory Powers Act - RIPA) on point and this situation seems to fall under Part I, Chapter II of that Act (access to communications data). Objectionable though RIPA might be, it does provide some safeguards. It becomes useless, though, when the police can evade those safeguards by falling back on an ordinary search warrant. Second, it's certainly true that Indymedia is being treated less favourably than other media organisations, perhaps in an attempt to harass or shut down its operations. As commenters on the Indymedia site note:

The point is whether or not the seizure of the server is justified. I really don't think that should a letter be written to the Times about such behaviour the police would seize all copies of the Times, or their computers.

The seizure of the Indymedia Bristol server illuminated deficits in the law. Law protecting journalists were drafted with mainstream news organisations in mind, so it cannot cope with media collectives. Whilst the police might well have had good reason to investigate the claims made on Indymedia Bristol's web site, by effectively shutting down the whole operation the police have acted insensitively and have used rather extreme methods, especially when Bristol IMC have been far from uncooperative.