A UK Government Department Uses Hacking Powers to Catch Price-Fixing Cartels

Over the past few months, traditionally tight-lipped UK law enforcement agencies have released snippets of how they use "equipment interference," or hacking powers. In response to enquiries from Motherboard, one government department has been unusually forthcoming about what it actually uses hacking for: catching price fixers and others involved in criminally anti-competitive behaviour.

The Competition and Markets Authority (CMA) is responsible for investigating company mergers that could restrict competition, tackling practices and market conditions that make it difficult for consumers to exercise choice, and investigating potential breaches of UK or EU prohibitions against anti-competitive agreements. In particular, the department investigates price-fixing cartels.

"Cartels typically take the form of agreements between competitors to fix prices, share customers or markets, limit production or supply, or to rig bids for contracts," Simon Belgard, a spokesperson for the CMA, told Motherboard in an email. "They are amongst the most egregious forms of anti-competitive conduct and are commonly conducted in secret, making them difficult to detect and prove without such powers."

The CMA is briefly mentioned in the government-issued equipment interference draft code of practice, published in spring of this year, which notes that the agency must be investigating a serious crime under the Enterprise Act 2002, and specifically section 188, in order to use hacking tools.

"Criminal cartels are akin to complex fraud, and can operate over many years at the expense of consumers and taxpayers as a result of higher prices and reduced choice. As such the regulated use of investigatory powers, including equipment interference, plays a critical role in the CMA's investigations," Belgard continued.

This use of hacking tools shows a proliferation of powers which until recently weren't even officially acknowledged by the UK government or law enforcement agencies.

According to a factsheet published by the government in November 2015, equipment interference, sometimes referred to as computer network exploitation, varies in complexity. At the lower end of the spectrum, an investigator might use a target's login credentials to access data on a device. These capabilities can go right up to remotely installing malware on a phone or computer.

The National Crime Agency has been relying on a decades-old law that some experts argue was never designed for computer hacking to justify its operations, and the CMA is no different.

"The CMA has such powers under the Regulation of Investigatory Powers Act 2000 and the Police Act 1997. The Government is proposing to update these in the Investigatory Powers Bill," Belgard said.