We have decided not to consent to a request from an individual to begin a prosecution of BT Group Plc and Phorm Inc in relation to alleged unlawful interception of internet browsing data.
Prosecutions for unlawful interception require the CPS’s consent. After a thorough review of the available evidence, the CPS has decided there is currently insufficient evidence to begin a prosecution under section 1 of the Regulation of Investigatory Powers Act (RIPA) 2000 and it would not be in the public interest to proceed any further.
The PageSense software (later known as Web Wise), created by Phorm and used by BT, stored a cookie on a user’s computer and covertly gathered selected information on their internet browsing habits. The software used this data to automatically target web-based advertisements at the user.
An unannounced trial of this technology, involving about 18,000 BT customers, took place during 2006.
Andrew Hadik, reviewing lawyer for CPS London’s Complex Casework Unit, said:
“We have thoroughly reviewed all of the material supplied by the individual who wished for us to consent to a prosecution, as well as the evidence provided by City of London Police, BT and Phorm. On the basis of the evidence gathered and with advice from legal and technical experts, we have determined the extent and seriousness of the alleged criminality.
“At present, the available evidence is insufficient to provide a realistic prospect of conviction. In the vast majority of cases, we would only decide whether to prosecute after the investigation had been completed and after all the likely evidence had been reviewed. In rare cases, however, it may become clear prior to the collection and consideration of all the likely evidence that a prosecution would not be in the public interest.
“We would only take such a decision if we were satisfied that the broad extent of the criminality had been determined and that we could make a fully informed assessment of the public interest. This is such a case.
“We obtained expert evidence to enable us to understand how the technology worked, how many people were affected and how they were affected. Those are the key elements of the alleged offending. Even if further evidence were available and collected, we are satisfied that it could not change our assessment.
“We have concluded a prosecution would not be in the public interest. As such, consent to a prosecution cannot be given.”
The review identified several public interest factors against prosecution:
- BT and Phorm received considerable legal advice concerning the use of this software and were advised its use was unlikely to be contrary to section 1 of RIPA. The Home Office also provided informal advice that stated the same. Following the second trial, BT received further and conflicting legal advice that led to it halting the covert trials. As there was no evidence to suggest either company acted in bad faith, it could be reasonably argued that any offending was the result of an honest mistake or genuine misunderstanding of the law;
- Both companies cooperated with the police investigation;
- The behaviour in question is unlikely to be repeated. After the first two trials, BT conducted a further single, public trial of the technology (in late 2008). Phorm now requests the user’s consent;
- The trial was of limited duration and limited application. The data gathered was anonymised and processed without human intervention and later destroyed;
- There has already been an investigation by a regulator, the Information Commissioner's Office, which concluded there was “no evidence to suggest significant detriment to the individuals involved” and took no action;
- There is no evidence to suggest that anyone affected by the trial suffered any loss or harm as a result;
- Taking into account all of the above, a court would be likely to impose only a nominal penalty.
Mr Hadik continued:
“The CPS was also asked to consider if an offence had been committed under the Computer Misuse Act 1990 or the Copyright Designs and Patents Act 1988.
“The core alleged criminality in this case was the possibly unlawful interception of data, not computer modification or copyright. Additionally, the same factors that would weigh against a prosecution in relation to the alleged interception would also apply to a prosecution for another offence.”
All of the concerned parties have been notified of our decision.
Notes
• The request for consent was received in September 2008 and the CPS’s initial review of the evidence was completed in June 2009. Expert legal and technical advice was then required, which was received in April 2010. The City of London Police was asked to make further enquiries in May 2010 and the last substantial evidence was provided to the CPS for consideration in October 2010.
• This decision has been taken under section 4.2 of the Code for Crown Prosecutors, which states: “In the vast majority of cases, prosecutors should only decide whether to prosecute after the investigation has been completed and after all the available evidence has been reviewed. However, there will be cases where it is clear, prior to the collection and consideration of all the likely evidence, that the public interest does not require a prosecution. In these rare instances, prosecutors may decide that the case should not proceed further.”
• Section 1 of RIPA states: “No proceedings for any offence which is an offence by virtue of this section shall be instituted in England and Wales, except by or with the consent of the Director of Public Prosecutions (DPP).” This consent is delegated to Crown Prosecutors, although the DPP has approved this decision.
