UK ISP Zen Internet Criticises Lack of Detail in Internet Snooping Bill

The Government’s new Internet Snooping ‘Investigatory Powers Bill‘ is very light on technical detail and being rushed into life so quickly that even now none of the major or minor ISPs seem to know what will actually be required of them, which is causing real concerns for providers like Zen Internet.

As a quick recap, the Investigatory Powers Bill (IPB) was launched in November 2015 (here) and represents the third attempt by a Government of the UK to force ISPs into keeping a much more extensive log (Internet Connection Records) of their customers online activity (regardless of whether or not you’re suspected of a crime), which can be accessed upon request.

Under the current plans the Home Secretary, Theresa May, is hoping to push the new bill before Parliament during early 2016, which is despite the legislation raising significant cost (here) and privacy (ethical) concerns.

Equally the other significant obstacle is the fact that most ISPs still don’t know exactly what will be required of them (e.g. nobody has yet properly defined what an Internet Connection Record should constitute) and there have been some big faults in the Government’s apparent ability to understand how the Internet actually works (example).

At some point the bigger ISPs, most likely working alongside GCHQ (the UK Government’s digital spies), will have to build new or re-engineer and expand upon their existing systems in order to implement the law, which is a hugely expensive and time-consuming process. But none of that can even start without more detail and then there are the challenges of on-going upkeep.

Note: Our understanding from a recent debate between ISPs and the Home Office is that the bill may not be forced upon smaller ISPs, but this has yet to be clarified.

Gary Hough, Zen’s Regulatory Manager, said:

“Unfortunately the bill is very light on actual detail so this makes it even much more difficult for those who would have to do the work. Of course once the systems have been designed and built that is only the start because then they face the small matter of having to train staff in the new law, how to manage and continually administer the data securely and under existing European regulatory frameworks such as data protection rules.

Another major concern is the very real risk of all of this data on UK citizens becoming an attractive target for criminals who may want to exploit it for criminal gain. CP’s under an order are already in the spotlight making it easy for criminal elements to target them.

And what happens should the customers of those CP’s currently under an order decide to move to those providers who are not? This increases the risk for those smaller CP’s becoming a magnet inadvertently for criminals who wish to remain free from monitoring and scrutiny.

There are those who would say we shouldn’t be worried about interception and as a law abiding internet user who doesn’t communicate with criminals then you could be forgiven for thinking that too, but remember that this law would mean bulk interception would take place on everyone rather than targeted. Your data is going to be routinely gathered whether you have done anything wrong or not.

The bill is currently weak on detail and that really concerns us as a provider who may well have to retain its customer’s data under an order in the future. Without that detail we simply don’t know how it would impact us or our customers at the moment and it makes it very difficult to plan, cost and build the systems with the safeguards that we would need to go with it should we be forced to.”

The position taken by Zen Internet above is by no means unique and has so far been echoed by practically every other ISP from BT down. But the Government has allowed so little time for debate that it’s becoming increasingly difficult to see how the first official draft will be able to balance such concerns against their expectations of what the bill should deliver, short of perhaps hiring Harry Potter to cast a magic spell.

Meanwhile MPs won’t have to worry about being snooped on like the rest of us because they will be exempt (we’re still not sure how that will work, accurately, in practice), while online criminals and terrorists still have plenty of options for avoiding the bill’s measures; many of which may also be adopted by consumers en masse to avoid unnecessary snooping.