Stanford, R. v

For the exemption in section 1(6)(a) of the Regulation of Investigatory Powers Act 2000, a person has a right to control a private telecommunications system only where they have authority to authorise or forbid its operation or use. Mere ability, even unrestricted ability, to access, operate or manipulate the system does not suffice.

This construction gives effect to section 1’s purpose of protecting the privacy of private communications. It prevents lax password practices from creating criminal immunity for unauthorised interception. In sentencing, the seriousness of interception materially depends on the nature of the information obtained and the purpose for which it was sought. Confidential commercially significant material intercepted for commercial advantage is serious wrongdoing and may justify both custody and a substantial fine.

The applicant, formerly deputy chairman of Redbus, pleaded guilty at Southwark Crown Court to unlawful and unauthorised interception of electronic mail communications contrary to section 1(2) of the Regulation of Investigatory Powers Act 2000. He had obtained emails through mirroring rules created by another employee using an administrator username and password.

Before the plea, the trial judge ruled that the employee did not fall within the exclusion from criminal liability in section 1(6). The applicant contended that access credentials and unrestricted technical ability gave the employee a right to control the system. He sought leave to appeal against conviction and sentence after receiving a suspended six-month sentence, a £20,000 fine, and costs.

The central issue was the meaning of a person having a right to control the operation or use of a private telecommunications system.

1. Leave to appeal against conviction and sentence was refused. The court held that the trial judge’s construction of section 1(6)(a) of the Regulation of Investigatory Powers Act 2000 was plainly correct.

2. A right to control the operation or use of a private telecommunications system means authority to authorise and forbid operations or use. It is wider than a right personally to operate or use the system, and does not arise merely because a person has credentials enabling unrestricted technical access. The court applied the reasoning on control in R v Bow Street Metropolitan Stipendiary Magistrate and Another, ex parte Government of the United States of America [2000] 2 AC 216.

3. The statutory context and purpose confirmed that construction. Section 1 protects the privacy of private telecommunications, addressing the deficiency identified in Halford v United Kingdom (1997) 24 EHRR 523. A broader interpretation would allow any employee with unrestricted system access, including through lax password practices, to intercept others’ communications without criminal liability. That would defeat the legislation’s primary criminal protection.

4. The court also rejected the characterisation of the conduct as close to civil rather than criminal liability. The interception was planned, concerned confidential material of financial significance, and was intended to secure commercial advantage by obtaining control of the company. Those features passed the custody threshold. A six-month sentence suspended for two years, combined with a substantial fine, was appropriate.

• Court of Appeal (Criminal Division) — refused leave to appeal against conviction and sentence, leaving the Crown Court orders in place.

• Crown Court at Southwark — on 14 September 2005 the applicant pleaded guilty to an offence under section 1(2) of the Regulation of Investigatory Powers Act 2000, following a preliminary ruling on section 1(6). On 15 September 2005 he received six months’ imprisonment suspended for two years, a £20,000 fine, and £7,000 prosecution costs.