After more than 12 months of debate, the Investigatory Powers Bill (dubbed by the media, like all interception legislation, as the ‘Snooper’s Charter’) passed through its final stages in the House of Lords on 16 November, granting the government surveillance powers described by US whistle-blower Edward Snowden as “the most extreme … in the history of western democracy.”
The Bill is designed to future proof law enforcement powers in the face of ever-evolving forms of digital communication. It covers the following:
- General privacy protections
- Lawful interception of communications
- Authorisations for obtaining communications data
- Retention of communications data
- Equipment interference
- Bulk warrants
- Bulk personal dataset warrants
- Oversight arrangements
Upon receiving Royal Assent, the date of which is still unclear, the Bill will mark a major overhaul of the UK’s regimes on communications data retention and law enforcement access rules. As Datonomy readers will be familiar, the new legislation has been under discussion for many years under successive governments of different political leanings. The current Bill began its formal journey through Parliament in March 2016, having been published for pre-legislative scrutiny in November last year. It follows many of the recommendations made in July 2015 by David Anderson QC, the Independent Reviewer of Terrorism Legislation, in his 370 page report, “A question of trust”.
In setting out his recommendations for reform, David Anderson QC stated:
“My aim has been to build on the best features of the current regime and to learn from the practice of other countries. The resulting framework aims not only to satisfy the majority who broadly accept current levels of investigatory activity and supervision, but to help build trust among sceptics both in the UK and abroad. The opportunity now exists to take a system characterised by confusion, suspicion and incessant legal challenge, and transform it into a world-class framework for the regulation of strong and vital powers. I hope that opportunity will be taken.”
Datonomy will be providing fuller analysis but it is clear that the Bill will have a profound impact on data companies. For example, areas of particular concern and controversy during the passage of the Bill include the fact that Internet providers will be required to record which services their customers’ devices connect to, such as a website or an instant messaging application. The Home Office says it will help combat terrorism, but critics of the law have warned of the potential for it to be used for the wrong reasons. The Liberal Democrat peer Lord Strasburger, stated: “we do have to worry about a UK Donald Trump. If we do end up with one… we have created the tools for repression.”
In their written evidence on the Bill earlier this year, many global tech companies, while welcoming the rationalisation of the rules, raised concerns about various aspects of the new proposals. For example, the companies criticised the powers to break encryption that the Bill offers the government. Apple’s iMessage and Facebook’s WhatsApp both contain encryption technology that ensures that messages can only be read by the people sending and receiving them, the new Bill could force companies to break the encryption, should the government demand.
Conceivably this could see a growth in the success of virtual private network (VPN) operators, as reported here by the BBC, as their ability to scramble a user’s internet traffic means that the only data they can provide to the authorities is the fact that a subscriber used a VPN. Contrast this with Internet Service Providers (ISPs), who would be required to hand over a full log of everywhere a customer has visited, and it is easy to see why ISPs are nervous.
Interception legislation is by its very nature controversial. It remains to be seen whether the Government has managed to achieve a better balance this time – or whether the “confusion, suspicion and incessant legal challenge” will simply go on. Datonomy will keep you updated and provide further analysis as the final text of the Act becomes available.