The Coming UK Surveillance Debate: Communications Data Retention, Part 2

One of a series of posts on the forthcoming Investigatory Powers Bill

Previous: Communications Data Retention, Part 1

Next: Communications Data Retention, Part 3

Third party data collection. The Communications Data Bill would have required CSPs to collect and retain third party data travelling across their networks from foreign sources (such as US platforms), so as to make it accessible to communications data demands from UK authorities. However the Anderson Report hints (see quotation below) that the case for third party data collection may now be less strongly pressed by law enforcement.

Recommendations of the three Reviews on collection and retention of third party data:

ISC	No recommendation
Anderson	There should be no question of progressing proposals for the compulsory retention of third party data before such time as a compelling operational case may have been made, there has been full consultation with CSPs and the various legal and technical issues have been fully bottomed out. None of those conditions is currently satisfied. (Recommendation 18)
RUSI	No recommendation

Request filter. The Communications Data Bill would have introduced a request filter, capable of searching across datasets held by multiple communications providers. As with third party data collection the Anderson review hints at a diminution in pressure from law enforcement:

“The Communications Data Bill contained provision for the retention of third-party data and for a request filter. Law enforcement still endorse the operational requirements which those provisions were meant to address, but want to engage further with industry on the best ways of meeting them.” [9.11]

None of the reviews makes a specific recommendation in respect of the request filter, beyond more general comments made about the draft Communications Data Bill.

Retention of so-called IP address resolution data has already been introduced in the Counter-Terrorism and Security Act 2015.  The government has said that this is only a stepping stone. While exactly what more it may have in mind is unclear, it is most likely referring to retention of weblog data. That is discussed in the next post.