Intelligence and Security Committee Criticise UK Internet Spying Bill

The Intelligence and Security Committee has described parts of the Government’s new Draft Investigatory Powers Bill (IPB), which aims to expand the United Kingdom’s existing Internet spying laws to include every citizen, as being “inconsistent and largely incomprehensible.”

The bill would among other things force broadband ISPs to log a much bigger slice of everybody’s online activity and then keep that log for up to 12 months, irrespective of whether or not you’ve committed a crime. It would also require companies to provide access to view encrypted communications, which could be difficult in situations where even the provider cannot see what is being said; this also risks making UK built Internet communications services less competitive.

Furthermore the bill would also make the related Internet Connection Records more easily accessible for law enforcement agencies through a complex “Request Filter” (not unlike a central database) and Police wouldn’t need a full warrant in order to gain access, although a warrant would still be needed for more targeted and detailed interception.

Suffice to say that ISPs, rights groups, politicians and many others have raised concerns about the bills impact upon personal privacy, its cost, the limited time for debate and the technical challenges with even being able to make it work. Today’s report from the ISC supports some of those concerns and highlights a few others.

Dominic Grieve QC MP, Chairman of the ISC, said:

“Taken as a whole, the draft Bill fails to deliver the clarity that is so badly needed in this area. The issues under consideration are undoubtedly complex, however it has been evident that even those working on the legislation have not always been clear as to what the provisions are intended to achieve. The draft Bill appears to have suffered from a lack of sufficient time and preparation.”

The Executive Director of the Open Rights Group, Jim Killock, has also welcomed the Intelligence and Security Committee’s report and suggested that a revised bill could soon follow. “There have been suggestions that a new version of the Bill will be published by the end of February. The Home Office needs a lot longer than two weeks to redraft their bill. Theresa May must ensure that the ISC’s very serious and considered demands are dealt with in full.”

ISC – Summary of the Key Concerns

* Privacy:

We had expected to find universal privacy protections applied consistently throughout, or at least an overarching statement at the forefront of the legislation. Instead, the draft Bill adopts a rather piecemeal approach, which lacks clarity and undermines the importance of the safeguards associated with these powers. We have therefore recommended that the new legislation contains an entirely new Part dedicated to overarching privacy protections, which should form the backbone of the draft legislation around which the exceptional powers are then built. This will ensure that privacy is an integral part of the legislation rather than an add-on.

* Equipment Interference:

At present the draft Bill only covers the Agencies’ ability to conduct Equipment Interference to obtain information (Computer Network Exploitation): other IT operations will continue to sit under the broad authorisations provided to the Agencies under the Intelligence Services Act 1994 regime. This discrepancy is unnecessary and counter to transparency. We therefore recommend that all IT operations are brought under the same legislation, with the same authorisation process and the same safeguards.

In relation to the authorisation process, we have not been provided with sufficiently compelling evidence as to why ‘Bulk’ Equipment Interference warrants are required: in our opinion ‘Targeted’ Equipment Interference warrants can be drawn sufficiently broadly that a separate ‘Bulk’ warrant is unnecessary. We therefore recommend that Bulk Equipment Interference warrants are removed from the legislation.

Bulk Personal Datasets:

The draft Bill provides for the Agencies to obtain a Class warrant allowing them to obtain any number of Bulk Personal Datasets of a general class or type (for example, travel data). As a general principle the Committee consider that class authorisations should be kept to an absolute minimum. In this case, given that each Bulk Personal Dataset potentially contains personal information about a large number of individuals – the majority of whom will not be of any interest to the Agencies – the Committee considers that each dataset is sufficiently intrusive that it should require a specific warrant. We therefore recommend that Class Bulk Personal Dataset warrants are removed from the legislation.

Communications Data:

The approach to the examination of Communications Data is currently inconsistent and confusing. The Committee considers it essential that the same safeguards are applied to the examination of all Communications Data, irrespective of how it has been acquired. This must be clearly set out on the face of the legislation: it is not sufficient to rely on policy and good practice.

The full report is now available to download and covers a much wider remit, although we’re waiting for Thursday when the Joint Committee will issue their extensive and much more detailed study of the bill.