united-kingdom international police criminal-procedure encryption
Law enforcement requesting passwords from companies?
<p>Could UK law enforcement enforce <a href="https://www.legislation.gov.uk/ukpga/2000/23/section/49?timeline=false" rel="nofollow noreferrer">s.49 of RIPA 2000</a> on a company outside the UK, say Snapchat, Facebook, or Google, in order to retrieve a user's hashed password from their database to log into that users account?</p>
<p>If they could, will the company comply and provide them with the user's details or just say no?</p>
<p>And even if law enforcement didn’t use section 49 from RIPA but still asked for the users password, what will the company say?</p>

<p><strong>Q: Could UK law enforcement enforce RIPA section 49 on a company outside the UK?</strong></p>
<p><strong>NO</strong> For two reasons:</p>
<ol>
<li><p><a href="https://www.legislation.gov.uk/ukpga/2000/23/contents" rel="nofollow noreferrer">RIPA 2000</a> is not extraterritorial so only applies in England, Wales and Northern Ireland - there is no power to compel a foreign company to comply.</p>
</li>
<li><p>The  procedure to obtain material in an evidential format from, say, a foreign service provider is not RIPA but usually via an <a href="https://en.m.wikipedia.org/wiki/Letters_rogatory" rel="nofollow noreferrer">International Letter of Request</a> which <em>may negate the need for the key</em> if it can't be cracked by digital forensics investigators.
The ILOR will specify what the UK authorities are seeking which may be just the key but will probably be a portion of, if not the entirety of, the available stored data relating to the username, IP or any other identifier <strong>therefore making the need for the key redundant</strong>.  It's then up to the receiving jurisdiction to decide on the format with which to proceed (terminology varies around the world so it could be called a warrant, production order, writ etc). The recipient company is legally obliged to comply just like everyone else who gets served with a lawful court order.</p>
</li>
</ol>
<p>(Also, for general interest, some countries have mandatory reporting for certain types of online offending, such as the American <a href="https://en.m.wikipedia.org/wiki/National_Center_for_Missing_%26_Exploited_Children" rel="nofollow noreferrer">Cyber Tip Line</a> operated by <a href="https://www.missingkids.org/HOME" rel="nofollow noreferrer">NCMEC</a> which can legally share information (but not necessarily in an evidential format) with national law enforcement agencies - although it's highly unlikely, if not impossible, that this would include the key.)</p>
<p><strong>Q: If law enforcement didn’t use section 49 from RIPA but still asked for the users password, what will the company say?</strong></p>
<p>In my experience they don't usually say anything to requests that just <em>ask</em> for information, but if they do reply it's words to the effect <strong>NO, get a warrant</strong> (see point 2, above).</p>

<h2>Yes</h2>
<p>The law gives the nominated agencies the power to demand keys from anyone, anywhere. Refusal to hand them over is a crime punishable by imprisonment of up to 2 years (5 years for child abuse or national security reasons). People have been tried, convicted and gaoled for non compliance.</p>
<p>As a practical matter, enforcing this on people outside the jurisdiction of the UK would require the cooperation of the country the person was located in. Many countries have <a href="https://en.wikipedia.org/wiki/Key_disclosure_law" rel="nofollow noreferrer">similar laws</a> so extradition is a possibility.</p>
