UPDATE Labour Party Threatens to Delay UK ISP Internet Spying Bill

The UK Labour Party has today set out a list of changes that it would like to see being made to the controversial Draft Investigatory Powers Bill, which aims to force broadband ISPs into logging a much bigger slice of your online activity and to then share it with the security services.

Apparently the logs (Internet Connection Records) would be stored by ISPs for up to 12 months and the police will not require a warrant in order to access this Internet history, which will occur regardless of whether or not you’re even suspected of committing a crime.

Many see the development as a useful tool for helping to combat the threat from terrorism and other crimes, while others fear that such monitoring goes too far (i.e. an invasion of privacy that could be abused), would be far too expensive to implement, has many technical challenges left to overcome and lacks good safeguards.

The first IPBill draft was only published in November 2015 (summary) and since then there have been three major reports (here, here and here), all of which have poked huge holes in the Government’s approach and pointed to significant concerns. A revised bill was recently published (here), which made some improvements but still left concerns (here).

However so far the bill has been allowed to proceed because both the SNP and Labour Party have abstained from a vote that would block it, which is largely because they want the bill to be changed rather than thrown out completely.

Today Andy Burnham MP, Labour’s Shadow Home Secretary, has sent an open letter to the Government’s Home Secretary, Theresa May MP, which warns that the party “will be unable to support a timetable that puts the Bill on the Statute Book by December this year” unless the changes they’ve set out are made.

Letter to the Home Secretary on the Investigatory Powers Bill

Rt. Hon. Theresa May MP
Home Secretary
Home Office
2 Marsham Street
London SW1P 4DF

4th April 2016

Dear Theresa

Investigatory Powers Bill

Following the Second Reading, I thought it would help if I set out clearly the issues on which Labour will need to see significant movement if we are to achieve our shared aim of a Bill which gives the authorities the capabilities they need in the digital age whilst providing strong privacy safeguards for the public. The current Bill is an improvement on earlier iterations but is still some way from achieving that essential balance.

1. Privacy

As the Intelligence and Security Committee said in its report on the draft Bill, privacy protections should form the backbone of this legislation. We strongly agree. A presumption of people’s right to privacy at the start of the Bill would set the right context for the rest of the Bill and provide the basis from which the exceptional powers may be drawn. We consider this to be essential and ask that an amendment to this effect is accepted.

2. Internet Connection Records (ICRs)

I believe significant work is needed before this powerful new capability will be acceptable to the public. In light of the recent evidence to the Bill Committee, it would seem that the Bill goes beyond what is required by the Police and NCA. It is important that the capability created does not exceed that required by the Police and security services.

Our specific concerns in this area are as follows:

a) Definition

I remain of the opinion that the definition of “internet connection records” in Clause 54 is much too vague. What I would like to see in the Bill is a clear and consistent definition – in particular, a specification that ICRs can include domains but not URLs. Technology will change over time and, if ICRs are not clearly defined in law, they could evolve into something much more intrusive. It is essential, therefore, that the parameters of what can and cannot be included in an ICR are explicitly specified on the face of the Bill.

b) Thresholds

I believe the threshold at which ICRs can be accessed must be higher. At present, the Bill sets it at any crime. I do not think it is necessary or proportionate for information held in ICRs to be accessed in connection with lower-level offences. Instead, I think this threshold should be set at serious crime and that this should be defined in the Bill as an offence that attracts a maximum sentence of not less than three years in prison.

c) Access

Schedule 4 of the Bill sets out too wide a range of public bodies that will be able to access ICRs. I will want to see a much reduced list before this part of the Bill becomes acceptable to us.

3. Independent assessment of bulk powers

Whilst I accept the broad argument advanced by the authorities that powers to extract information in bulk form may provide the only way of identifying those who pose a risk to the public, the operational case for bulk powers which accompanied the Bill’s publication has significant gaps. This was clear from contributions made at Second Reading from both sides of the House.

Therefore, the simplest way to proceed would be, firstly, to produce a more detailed operational case and, secondly, to accept the recommendation of the Joint Committee and commission an independent review of all the bulk powers. That review should conclude in time to inform Report and Third Reading.

I would be open to a discussion about the various forms this independent review could take but it is imperative that we get it up and running. I will consider carefully the nature and extent of the bulk powers in this Bill in light of the review.

4. Definitions of “national security” and “economic well-being”

The justification for using the most intrusive powers within the Bill is on grounds of “national security” and “the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security”.

As I said at Second Reading, I understand the need for operational flexibility. But I consider these tests to be far too broad.

I am therefore asking you to accept the Joint Committee’s invitation to define “national security” more explicitly. Alongside terrorism and serious crime, it could include attacks on the country’s critical and commercial infrastructure. If you were to do that, the “economic well-being” test could be then dropped altogether. That would build reassurance that, in future, there could be no targeting of law-abiding trades unionists as we have seen in the past. As the Rt Hon Ken Clarke QC said during Second Reading:

“It is true that there is a vast amount of activity under the general title of economic well-being. I have known some very odd things to happen under that heading. National security can easily be conflated with the policy of the Government of the day. I do not know quite how we get the definition right, but it is no good just dismissing that point.”

The best way to address this point would be to define “national security” more precisely and drop “economic well-being” altogether.

5. Meaningful judicial authorisation and oversight

I welcomed your comment during the Second Reading debate that a “judicial commissioner will look not just at the process, but at the necessity and proportionality of the proposed warrant”. In view of this, I would ask that you bring forward amendments in Committee to remove references to a judicial commissioner applying “the same principles as would a court on an application for judicial review”. If the ‘double-lock’ is to command trust, it needs to be an ‘equal-lock’. That means a judicial commissioner having the same ability to look at the merits of the case and not just the process. Removal of the JR test would clear up any potential for confusion. In addition, the ‘double-lock’ is dependent on the judicial commissioner approving the decision of the Home Secretary to issue a warrant as set out in part 17 of the Bill.

6. Overarching criminal offence of deliberate misuse

Whilst I welcome the fact that the Bill contains a new offence of misusing communications data, it should be clearer that a criminal offence is created for the deliberate misuse of any of the Bill’s powers. This should relate to both the obtaining of data without due cause and any improper use to which obtained data is put.

7. Effective protections for sensitive professions

The Law Society is right to say that legal privilege must be more adequately protected than in the current Bill. In addition, the National Union of Journalists is concerned that the Bill weakens existing provisions for journalists to challenge intrusion into their work. Such concerns must be adequately addressed in Committee with appropriate amendments if we are to create legislation that commands the trust of the professions.

Regarding the work of elected representatives, I welcome your moves to codify the Wilson Doctrine but I question whether the Bill goes far enough. We believe the Prime Minister must authorise any warrants that target elected representatives, not simply consulted about them.

I hope you will accept that the seven points I have outlined are legitimate concerns and that you will work with us to address them properly.

If I determine that our concerns are not satisfactorily dealt with during the passage of the Bill, then we will be unable to support a timetable that puts the Bill on the Statute Book by December this year.

I hope that is not necessary and that we can together produce a Bill that commands a high degree of confidence and trust.

Yours sincerely

Rt Hon Andy Burnham MP
Shadow Home Secretary

Most of the requested changes seem quite fair and hopefully the Government will listen, although at the same time there’s not one mention about the issue of cost and this is an area that needs some significant clarification as most ISPs warn that the cost will be many times higher than the Government’s figure of £175m+ (consumers could end up being hit with a steep price hike).

Meanwhile any criminals or terrorists with even basic knowledge of how to use the Internet will simply be able to use encrypted services and VPNs that exist outside of UK control, thus avoiding all of this.

UPDATE 26th May 2016

Labour has managed to extra some concessions on points 3 and 4 above. The Home Secretary has initiated a review of the operational case for bulk powers, subject to Labour’s agreement on the terms of reference for the panel, and agreed that investigatory powers could not be used in respect of legitimate trade union activity. Still a lot to do though (here).