Government Attempts to Expand UK Internet Snooping Bodies

The Government appears to have decided that, while the country’s attention is distracted by the COVID-19 (Coronavirus) crisis, it might as well try to increase the number of bodies capable of obtaining communications data from UK phone, mobile and broadband ISPs under the Investigatory Powers Act (IPAct).

At present the IPAct forces ISPs into logging the Internet Connection Records (ICR) of all their customers for up to 12 months (e.g. the IP addresses of the servers you’ve visited and when), which can be accessed without a warrant and occurs regardless of whether or not you’re suspected of a crime. However, obtaining the actual content of a communication, still requires a warrant.

Now it appears as if MPs want to expand the number of public authorities that can access this highly sensitive personal data, such as by including the Civil Nuclear Constabulary, Environment Agency, Insolvency Service, UK National Authority for Counter Eavesdropping and Pensions Regulator into the mix (see the proposed amendment).

A related memorandum has been issued (here) in order to better explain the reason behind each of the five additions to the existing list, which is already comprised of various security services (police), government departments and public agencies.

Apparently the five public authorities who will gain the power to obtain communications data will do so because they are “increasingly unable to rely on local police forces to investigate crimes on their behalf.” But instead of working to improve the local police forces..

Extract from the Memorandum

Addition of the Civil Nuclear Constabulary (CNC):

Although the current threat to nuclear sites in the UK is assessed as low, the risk posed by certain nuclear hazards remains high. It can also be difficult to accurately assess risk without the full information needed. Although the CNC does not expect to make large numbers of communications data requests, it requires powers to investigate threats to the most sensitive nuclear sites in the UK. For example, the Sellafield site holds the four biggest nuclear risks and hazards in Europe and the largest stores of civil plutonium in the world.

Addition of the Environment Agency:

The Environment Agency has a significant regulatory and enforcement remit covering the natural environment in England. They are responsible for investigating over 400 different types of offence, which result in over 40,000 suspected offences each year. This includes £600 million of waste crime annually.

In June 2018, the Secretary of State for the Environment (Rt Hon Michael Gove MP) announced an independent review into waste crime which concluded that: “the Home Office should provide regulations under Part 3 of the Investigatory Powers Act 2016 to allow the Agency to acquire communications data to tackle serious and organised waste crime”.

Addition of the Insolvency Service:

Fraudulent trading committed by company directors and cases involving breaches of company director disqualification orders, feature in a significant number of investigations. Such breaches are considered by the courts to be serious misconduct attracting custodial sentences; individuals will often have been disqualified for previous company failings, incurring losses to creditors.

The Insolvency Service assess that by acquiring communications data and being able to attribute subscribers to telephone numbers and analyse itemised billings, significant weight will be added to evidence that can be gathered. IP addresses and underlying e-mail account details will also be increasingly useful lines of enquiry to solve crimes within their remit.

Addition of UK National Authority for Counter Eavesdropping (UKNACE):

UKNACE is a critical organisation that protects our national security. UKNACE detects hostile technical espionage activities and eavesdropping activity against UK assets in UK government buildings, secure environments, embassies and other UK controlled overseas environments that process sensitive material. UKNACE requires communications data powers in order to identify and locate an attacker or an illegal transmitting device.

Addition of The Pensions Regulator (TPR):

TPR has become responsible for enforcement of employer automatic enrolment duties, which have been gradually rolled out to over one million businesses since 2012. This has dramatically increased the scale of TPR’s enforcement activity and highlighted the need for effective sanctions, including prosecution.

In parallel with this, TPR has adapted its approach to its other areas of responsibility, putting more emphasis on prosecution as a means of securing compliance and punishing wrongdoing. Communications data powers will be highly valuable in investigations as digital footprints become increasingly significant.

Some of these additions do make sense, while others seem more like mission creep, although it could equally be seen as the system working well and being expanded accordingly. A spokesperson for the Home Office said: “To protect national security and investigate serious crimes, law enforcement and relevant public authorities need the ability to acquire communications data. These powers are only used where it is absolutely necessary and proportionate and are independently authorised by the Office for Communications Data Authorisations, except in urgent or national security cases.“