Do I Have to Give My Passwords to the Police?

Devices such as phones and laptops are usually password or PIN protected. While this security measure is useful in an everyday context, some people might use it to their advantage to hide evidence of crime.

For this reason the powers afforded to authorities to obtain that information has been increasing. Police forces have the powers to request a ‘key’ – that is a password, PIN, or other data such as an algorithm that allows data being created in an intelligible format.

During the course of an investigation, police have powers to seize property such as computers and phones that may be password protected. Police also have the right to access those devices and may ask you for the passwords or access PIN.

Initially, a person being investigated will be asked to reveal any ‘key’ during an interview at the police station.

You have the legal right to refuse any requests for your passwords and police may subsequently attempt to gain entry to your devices using software that’s designed to access a device.

The police also have unlimited time in which to return a device, and cracking software can often take months, if successful at all.

What are the Consequences of Non-Compliance?

Regulation of Investigatory Powers Act, or RIPA, was introduced in 2000 and gives the police powers to serve notice, compelling a suspect to share their password or PIN details. It was originally introduced as an anti-terrorist measure but is regularly used in criminal investigations.

But can they force you to give away your passwords?

No. No one can literally force you to share a password, but not doing so can result in a prison sentence. Under section 49 of RIPA police can serve notice to compel a suspect to disclose the information and section 53 makes it a criminal offence not to comply with the terms of a s.49 notice. If found guilty you can serve up to two years imprisonment or up to 5 years imprisonment in cases involving national security or child indecency. And while it’s rare, police do prosecute. In their post on the subject these solicitors in Ipswich say:

“Although prosecutions for failure to comply with a s.49 notice are rare, they do occur. Stephen Nicholson was sentenced to 18 months imprisonment for failing to provide his Facebook password to the police during a murder investigation of a schoolgirl. Tajan Spalding was sentenced to 8 months imprisonment for failure to provide his password during a drug investigation, the police ultimately took no further action in the drug investigation.”

In the last example, Spalding served a sentence under section 53 of the Regulation of Investigatory Powers Act for not providing any passwords rather than any of the alleged crimes being investigated.

So, I Always Have to Give My Passwords?

To get a section 49 notice that compels someone to provide their passwords, the police must obtain permission from a judge.

A judge will want to know:

• The protected information is actually in the possession of the person given notice
• It’s necessary, for example, in the interest of national security, preventing or detecting crime or in the interests of the economic wellbeing of the UK
• Disclosure of the passwords is proportionate
• The protected information cannot be obtained by other reasonable means

You might decide to defend any decision to not provide a password after being served a Section 49 notice. For example, if you can show you don’t know the passwords or PIN, or that the grounds for serving the notice were not met. This might be that the police could obtain the information by other means, or that disclosure was not proportionate.

Final Thoughts

There are naturally criticisms of these laws. For example, compelling a suspect to provide a password or PIN might be forcing them to incriminate themselves and erode their privacy. And imprisoning people for failing to provide a password if they’ve subsequently been found ‘Not Guilty’ at trial is to some, considered as disproportionate. There are also additional challenges for courts where a suspect cannot remember the password or claims not to remember the password.

If you should find yourself in such a situation, the advice is clear. Get a legal representative as soon as possible.