Unauthorised Access: Physical Penetration Testing For IT Security Teams

A.1.3. Regulation of Investigatory Powers Act

Despite its title, the Regulation of Investigatory Powers Act (RIPA) doesn't regulate a great deal. In fact, the primary purpose of RIPA was to give law enforcement and the security services greater powers of surveillance. There are some disturbing aspects to RIPA. For example, the government can demand you turn over passwords and encryption keys with an automatic assumption of guilt if you don't. If you do turn over the relevant keys, you are forbidden from discussing it with anyone else. There are provisions for automatic prison sentences of two and three years respectively if you violate those two clauses.

Clearly, there are concerns here for a penetration testing team; you may be required to turn over confidential client data on a whim and not be able to inform your client you've done so. However, that is really only of secondary concern; the primary issue is in the excerpt.

RIPA Excerpt Any interception of a communication which is carried out at any place in the United Kingdom by, or with the express or implied consent of, a person having the right to control the operation or the use of a private telecommunication system shall be actionable at the suit or instance of the sender or recipient, or intended recipient, of the communication if it is without lawful authority and is either – an interception of that communication in the course of its transmission by means of that private system; or an interception of that communication ...