The Coming UK Surveillance Debate: Extraterritoriality, Transparency and Data sharing

One of a series of posts on the forthcoming Investigatory Powers Bill

Previous: Targeted Interception

Next: Communications Data Retention, Part 1

Extraterritoriality. DRIPA (the Data Retention and Investigatory Powers Act), enacted in July 2014 gave various kinds of extraterritorial effect to RIPA’s interception and communications data acquisition provisions. The Home Office insisted that the amendments clarified RIPA in order to achieve what had always been intended. 

Extraterritoriality is controversial and carries the risk of creating clashes between laws of different countries.  Not surprisingly, given the speed at which DRIPA was rushed through Parliament, there are oddities and anomalies.  Two concern extraterritoriality:

(a) DRIPA provides that in assessing reasonable practicability of assisting with an interception warrant regard is to be had to restrictions and requirements under the law of a non-UK country in which interception steps are to be taken. This applies only to non-UK providers.  Yet a UK provider may have facilities outside the UK on which following DRIPA it may be required to perform interception.

(b) There is no equivalent provision for compliance with a communications data acquisition notice.

The government has published a summary of the work done so far by Sir Nigel Sheinwald, who in September 2014 was appointed a Special Envoy for intelligence and law enforcement data sharing. 

The recommendations of the three Reviews are:

ISC	No recommendation
Anderson	As suggested by the Venice Commission, the long-term resolution of this issue may require new international standards for privacy (5.39) Pending a satisfactory long-term solution to the problem, extraterritorial application should continue to be asserted in relation to warrants and authorisations, and consideration should be given to extraterritorial enforcement in appropriate cases.  (Recommendation 25)
RUSI	No recommendation

Transparency Transparency goes to the clarity and intelligibility of the published legislation and to the problem of secret law. If the rules under which the agencies are operating are not sufficiently public, then the regime may fail the human rights legality test that law should be accessible and its application reasonably foreseeable.

Broad discretionary powers are vulnerable to challenge on legality grounds. As the ISC observed:

“…the lack of clarity in the existing laws, and the lack of transparent policies beneath them, has not only fuelled suspicion and allegations but has also meant that the Agencies could be open to challenge for failing to meet their human rights obligations due to a lack of ‘foreseeability’. The adequacy of the legal framework and the greater need for transparency have been at the forefront of this Inquiry throughout.” (xvii)

Anderson emphasises the importance from a trust perspective, of avowing intrusive capabilities:

“Whilst the operation of covert powers is and must remain secret, public authorities, ISIC and the IPT should all be as open as possible in their work. Intrusive capabilities should be avowed. Public authorities should consider how they can better inform Parliament and the public about why they need their powers, how they interpret those powers, the broad way in which those powers are used and why additional capabilities may be required.”

The ISC made a similar point in their earlier report (see Recommendation BBB below). 

Several capabilities have come to light only since Snowden.  Anderson mentions thematic warrants and their underlying interpretation of RIPA Section 8(1) disclosed for the first time in the ISC report in March 2015; use of bulk personal datasets disclosed for the first time in the same report; and Computer Network Exploitation (CNE, or hacking in common parlance). That was disclosed in a Code of Practice in February 2015 as the consequence of legal challenges to the activities disclosed by Snowden.

An issue that may arise is whether oversight should consist not just of retrospective audit, but should include a more proactive transparency function – for instance publishing interpretations of statutes on the basis of which the agencies are operating.  The controversial Home Office interpretation of external communications would never have seen the light of the day but for the post-Snowden challenge to bulk interception  in the Investigatory Powers Tribunal.  If law enforcement and the agencies are operating on the basis of particular interpretations it is arguable that those form part of the law being applied and should, if the human rights test of legality is to be satisfied, be made public.

The recommendations of the reviews do not go as far as, for instance, requiring the appropriate oversight body proactively to ascertain and publish any relevant statutory interpretations on the basis of which law enforcement and the agencies are operating.

The recommendations of the three Reviews are:

ISC	The Intelligence Services Act 1994 and the Security Service Act 1989 provide the legal basis for the Agencies’ activities, and broad general powers to act in accordance with their statutory functions and purposes. We have concerns about the lack of transparency surrounding these general powers, which could be misconstrued as providing the Agencies with a ‘blank cheque’ to carry out whatever activities they deem necessary. We therefore recommend that the Agencies’ powers are set out clearly and unambiguously. (Recommendation MM) Section 7 of the Intelligence Services Act 1994 allows for a Secretary of State to sign an authorisation which removes civil and criminal liability for activity undertaken outside the British Islands which may otherwise be unlawful under UK law. … consideration should … be given to greater transparency around the number and nature of Section 7 Authorisations. (Recommendation OO) The Intelligence Services Act 1994 and the Security Service Act 1989 provide the legal authority for the acquisition and use of Bulk Personal Datasets. However, this is implicit rather than explicit. In the interests of transparency, we consider that this capability should be clearly acknowledged and put on a specific statutory footing. (Recommendation X) Given the nature of current threats to the UK, the use of Directions under [Section 94 of] the Telecommunications Act [1984] is a legitimate capability for the Agencies. However, the current arrangements in the Telecommunications Act 1984 lack clarity and transparency, and must be reformed. This capability must be clearly set out in law, including the safeguards governing its use and statutory oversight arrangements. (Recommendation VV) The first step is to consolidate the relevant legislation and avow all of the Agencies’ intrusive capabilities. This will, in itself, be a significant step towards greater transparency. … We recognise that much of the detail regarding the Agencies’ capabilities must be kept secret. There is, however, a great deal that can be discussed publicly and we believe that the time has come for much greater openness and transparency regarding the Agencies’ work. (Recommendation BBB)
Anderson	The new law should be written so far as possible in non-technical language. It should be structured and expressed so as to enable its essentials to be understood by intelligent readers across the world. It should cover all essential features, leaving details of implementation and technical application to codes of practice to be laid before Parliament and to guidance which should be unpublished only to the extent necessary for reasons of national security. (Recommendations 3-5) The general power under TA 1984 s94, so far as it relates to matters covered by this Review, should be brought into the new law and/or made subject to equivalent conditions to those recommended here. The same should apply to equipment interference (or CNE) pursuant to ISA 1994 ss5 and 7, so far as conducted for the purpose of obtaining electronic communications; interception pursuant to the Wireless Telegraphy Act 2006 ss48-49; and the acquisition and use of bulk personal data. (Recommendation 6) Existing and future intrusive capabilities within the scope of this Review that are used or that it is proposed be used should be: (a) promptly avowed to the Secretary of State and to ISIC; (b) publicly avowed by the Secretary of State at the earliest opportunity consistent with the demands of national security; and, in any event, (c) used only if provided for in statute and/or a Code of Practice in a manner that is sufficiently accessible and foreseeable to give an adequate indication of the circumstances in which, and the conditions on which, communications may be accessed by public authorities.  (Recommendation 9)
RUSI	A clear and transparent new legal framework and a more coherent, visible and effective oversight regime should be the basis for a public discussion about the appropriate and constrained power the British state should have to intrude into the lives of its citizens. This would be the essence of a new deal between citizen and government. (5.30) Transparency: How the law applies to the citizen must be evident if the rule of law is to be upheld. Anything that does not need to be secret should be transparent to the public; not just comprehensible to dedicated specialists but clearly stated in ways that any interested citizen understands. (Test 8) Legislative clarity: Relevant legislation is not likely to be simple but it must be clearly explained in Codes of Practice that have Parliamentary approval, are kept up-to-date and are accessible to citizens, the private sector, foreign governments and practitioners alike. (Test 9)

Data sharing RIPA is silent on soliciting and receiving intercept product from foreign agencies, such as from the US PRISM programme.  The IPT in December 2014 held that receipt of PRISM data was lawful in the future, on the basis that some internal rules disclosed by the government during the proceedings now provide a publicly available legal basis for the activity. The government may think it prudent for rules to be incorporated in future legislation.

The recommendations of the three Reviews are:

ISC	Future legislation should clearly require the Agencies to have an interception warrant in place before seeking communications from a foreign partner. (Recommendation SS) The safeguards that apply to the exchange of raw intercept material with international partners do not necessarily apply to other intelligence exchanges, such as analysed intelligence reports. While the ‘gateway’ provisions of the Intelligence Services Act and the Security Service Act do allow for this, we consider that future legislation must define this more explicitly (Recommendation TT)
Anderson	The new law should define as clearly as possible the powers and safeguards governing: (a) the receipt of intercepted material and communications data from international partners; and (b) the sharing of intercepted material and communications data with international partners; (Recommendation 8) Any transfer of intercepted material or communications data to third countries should be on the basis of clearly-defined safeguards, published save insofar as is necessary for the purposes of national security and monitored by ISIC. The same should apply to receipt, with the addition of a warrant governing any intercepted material that is sought. The new law should make it clear that neither receipt nor transfer should ever be permitted or practised for the purpose of circumventing safeguards on the use of such material in the UK. (Recommendations 76 to 79)
RUSI	Currently, there is insufficient clarity over the powers and safeguards governing the exchange of data and intelligence between international partners. (5.75)

[Revised 13 August 2015 with a fuller discussion of avowal of intrusive capabilities].

The Coming UK Surveillance Debate: Targeted interception

One of a series of posts on the forthcoming Investigatory Powers Bill

Previous: Bulk Interception, Part 3

Next: Extraterritoriality, Transparency and Data sharing

RIPA Section 8(1) governs the ordinary targeted interception warrants issued by the Secretary of State, naming one person or a set of premises as the interception subject. They have been relatively uncontroversial, apart from the perennial disagreement over whether warrants should be judicially authorised. Nevertheless targeted warrants give rise to some issues.

Reasonable suspicion. Although it is often imagined that a section 8(1) warrant requires reasonable suspicion, that is not made explicit in RIPA.

Thematic warrants. It emerged in the ISC Report (paras 42 to 45) that Section 8(1) has been used for the issue of so-called thematic warrants. These are warrants for which the named subject is a group or network of persons rather than an individual.  Such warrants are possible because RIPA defines a ‘person’ as “any organisation or any association or combination of persons”.  The ISC expressed concern as to the extent that thematic warrants are used and around associated safeguards.

Recommendations of the three Reviews on thematic warrants:

ISC	Thematic warrants must be used sparingly and should be authorised for a shorter timescale than a standard 8(1) warrant. (Recommendation D)
Anderson	My intention has been to encourage the use of thematic warrants (Recommendation 27), but within strict limits. The key issue here is the power of modification. It should normally be for a Judicial Commissioner to make major modifications to a specific interception warrant, e.g. the addition of a new person or premises to the schedule. (Recommendation 34)
RUSI	No recommendation

Ban on disclosure. Currently there is a blanket prohibition on disclosing the existence of both targeted and bulk interception warrants.

Recommendations of the three Reviews on disclosure:

ISC	Disclosure should be permissible where the Secretary of State considers that this could be done without damage to national security. (Recommendation C)
Anderson	Within the constraints imposed by national security, the current restrictions and prohibitions relating to the disclosure of warrants and intercepted material (RIPA ss15 and 19, Official Secrets Act 1989 s4) should be clarified and reviewed  in order to ensure, in particular, that: (a) there is no legal obstacle to explaining the uses (and utility) of warrants to Parliament, courts and public, and that (b) as recommended by the Police Ombudsman for Northern Ireland in his report of 30 October 2014 on the Omagh bombing, there is “absolute clarity as to how specific aspects of intelligence can be shared in order to assist in the investigation of crime”. (Recommendation 10)
RUSI	No recommendation

The Coming UK Surveillance Debate: Bulk interception, Part 3

One of a series of posts on the forthcoming Investigatory Powers Bill

Previous: Bulk Interception, Part 2

Next: Targeted Interception

Selection of intercepted material for examination. Whereas RIPA Section 8(4) controls what can be captured to form the pool of intercepted material, Section 16(2) limits the kinds of hook that can be used to fish in it: the selection factors. Section 16 is among the most obscure in RIPA. Furthermore when deciphered it is not as limiting as might be thought on first impression. That is especially true of the restrictions on searches relating to people within the British Isles. (See discussion here at [19] to [23].)

An important aspect of the selection factors system is that it can be and is used not just to find communications of persons against whom there are existing grounds for suspicion, but to look for new targets.  The agencies refer to this as ‘target discovery’. 

The agencies are fond of the analogy of finding a needle in a haystack.  The supposition is that a needle is recognisably different from the surrounding hay.  But to revert to the fishing metaphor, when you wind in the line it is not necessarily obvious whether your target discovery algorithm has caught a fish or a rusty tin. It may have found a genuine malefactor. But even if the material looks suspicious it may in fact be entirely innocent. An analyst cannot necessarily be certain about what s/he is looking at. 

This is true both of the content of communications and of communications data analysis, in which the agencies try to join myriad dots to spot a suspicious pattern, or (say) to home in on a possible identity for an unrecognised associate of a known terrorist.  This can be seen from GCHQ’s own description of target discovery, in which the end point of the communications analysis process is an ‘investigative lead’:

“Signals Intelligence can be a powerful tool to answer seemingly impossible questions. The ability to use fragmentary information to build theories and perform complex searches against our metadata can narrow down thousands of options quickly. We can hone in on the most likely targets and only when we have sufficient justification that a lead is suspicious do we have the ability and resource to dig deeper and look at content to progress our investigations. … 

Example case study continues 

Although still at the theory stage, we now have a possible real life identity for our stranger overseas. We can report the findings so far and pass the information to MI5 as an investigative lead.”

 The target discovery aspect of Section 8(4) is in principle more intrusive than using it only to find communications of known wrongdoers and suspects, since it can be used to form suspicions based on searches of data, rather than the converse: starting from a reasonable suspicion of wrongdoing as the justification for accessing someone’s data. The ISC Report described it thus:

"The examples GCHQ have provided, together with the other evidence we have taken, have satisfied the Committee that GCHQ’s bulk interception capability is used primarily to find patterns in, or characteristics of, online communications which indicate involvement in threats to national security. The people involved in these communications are sometimes already known, in which case valuable extra intelligence may be obtained (e.g. a new person in a terrorist network, a new location to be monitored, or a new selector to be targeted). In other cases, it exposes previously unknown individuals or plots that threaten our security which would not otherwise be detected." [90]

Criticisms of broad interception powers are sometimes answered along the lines of “well in reality we don’t do that”.  So for instance, although Section 8(4) undoubtedly empowers algorithmic data mining to search from scratch for suspicious behaviour, and the above extract from the ISC report appears to describe something of that nature, the agencies told the Anderson Review that that is unrealistic for intelligence analysis. 

"It is sometimes assumed that GCHQ employs automated data mining algorithms to detect target behaviour, as is often proposed in academic literature. That, it would say, is realistic for tasks such as financial fraud detection, but not for intelligence analysis."[14.43]

Typically they are said to start with a seed – in the GCHQ website case study quoted above, a stranger who was given a concerning message by a known terrorist group member. The Anderson report goes on:

“Much of [GCHQ’s] work involves analysis based on a fragment of information which forms the crucial lead, or seed, for further work. GCHQ’s tradecraft lies in the application of lead-specific analysis to bring together potentially relevant data from diverse data stores in order to prove or disprove a theory or hypothesis.” [14.43]

In a similar vein the Anderson report records that internal communications may be read if they are selected to be examined by reference to a factor not prohibited by Section 16(2), “although GCHQ inform me that they may not use this route in order to deliberately seek access to internal communications and that it is unlikely to occur in practice.” [6.57(c)]

Should broad powers be narrowed to correspond with actual practice? The Anderson report is entitled ‘A Question of Trust’. Sometimes broad powers may be thought useful as a way of maintaining the secrecy of specific techniques. However it could also be corrosive of trust if a government body armed with broad intrusive powers were stoutly to resist any narrowing of powers to match what is said to happen in practice. 

The recommendations of the reviews in relation to selection and examination of material collected under a bulk interception warrant are: 

ISC	Searching for and examining the communications of a person known to be in the UK should always require a specific warrant, authorised by a Secretary of State. (Recommendation Q) The communications of UK nationals should receive the same level of protection under the law, irrespective of where the person is located. The interception and examination of such communications should therefore be authorised through an individual warrant like an 8(1), signed by a Secretary of State. (Recommendation R) The Interception of Communications Commissioner should be given statutory responsibility to review the various selection criteria used in bulk interception to ensure that these follow directly from the Certificate and valid national security requirements. (Recommendation S)
Anderson	Content that relates to a communication involving a person believed to be in the UK should be made available to be read, looked at or listened to only on the basis of a specific interception warrant issued by a Judicial Commissioner. (Recommendation 79) The new law should in addition provide for appropriately rigorous and rights-compliant procedures for the purposes of authorising access to: (a) content that is acquired pursuant to a bulk warrant and that does not relate to a communication involving a person believed to be in the UK; and (b) (if Recommendation 42(b) is adopted), communications data that are obtained pursuant to a bulk warrant. (Recommendation 80)
RUSI	No specific recommendation

[Updated 13 August 2015 with additional extract from ISC report.]

The Coming UK Surveillance Debate: Bulk interception, Part 2

One of a series of posts on the forthcoming Investigatory Powers Bill

Previous: Bulk Interception, Part 1
Next: Bulk Interception, Part 3

The Section 8(4) certificate. Human examination of content captured under a Section 8(4) warrant is restricted in two ways.  Some types of selection factor are forbidden under Section 16. This prevents selection targeted at the communications of people for the time being within the British Islands, without express further authorisation or in some exceptional situations. Human examination must also be limited to material of a kind set out in a certificate issued by the Secretary of State and applicable to the warrant.

A curious feature of the current regime is that these restrictions do not apply to communications data intercepted alongside their parent content.  There is a growing sense that analysis of communications data (although in a broader sense than the RIPA definition – see Anderson 7.24) may be more important to the agencies than looking at content. The ISC said:

“We were surprised to discover that the primary value to GCHQ of bulk interception was not in the actual content of communications, but in the information associated with those communications.” [80]

The Section 8(4) certificate can be in very broad terms.  It has been suggested in the past that it could be as broad as communications with a named  country.  The ISC commented that the categories are: 

“expressed in very general terms”. The Anderson report added: “As a result, very large volumes of communications may be both intercepted and examined under a s8(4) warrant, though GCHQ’s safeguarding and compliance mechanisms, and limitations on storage capacity, limit what can be actively processed or used.”

The ISC for the first time provided an example of a certificate:

“Material providing intelligence on terrorism (as defined by the Terrorism Act 2000 (as amended)), including, but not limited to, terrorist organisations, terrorists, active sympathisers, attack planning, fund-raising”. [101]

Another example was:

 “strategic environmental issues including… ***” [102]

The ISC was concerned that the Certificate appeared unnecessarily ambiguous and could be misinterpreted. [103]

The recommendations of the reviews in respect of the Section 8(4) Certificate are:

ISC	In the interests of transparency the Certificate should be published. (Recommendation N)
Anderson	In lieu of the Certificate the purposes for which material or data is sought should be spelled out by reference to specific operations or mission purposes. (Recommendation 43(b))
RUSI	“recognising that even untargeted collection must be specifically aimed at achieving an authorised mission or intelligence requirement” (5.49)

Anderson suggests an example of an operation or mission-specific purpose: “attack planning by ISIL in Iraq/Syria against the UK”.

Anderson also recommended that bulk interception warrants to capture the content of communications should not be used where a proposed new type of bulk warrant limited to communications data would suffice. (Recommendation 42(b))

GCHQ had asked that such a warrant should extend beyond the current RIPA definition of communications data and include ‘content-derived’ metadata, such as an e-mail address mentioned in the body of an e-mail.  The Anderson recommendation does not appear to go this far.  However he does recommend a review, as open and inclusive as possible, of the borderline between content and communications data (Explanation 12(c), Recommendation 12).

The Coming UK Surveillance Debate: Bulk interception, Part 1

One of a series of posts on the forthcoming Investigatory Powers Bill

Previous: Legal and policy origins

Next: Bulk interception, Part 2

GCHQ’s bulk communications interception activity was one of the most significant of the Snowden revelations. Serially renewed Ministerial warrants under RIPA Section 8(4) are the authority under which GCHQ is able to conduct its TEMPORA programme, capturing communications in bulk from transatlantic fibreoptic cables.  The programme was said to process 40 billion items a day in 2012.  For more about the Section 8(4) warrant, see here and here.

The ISC report recorded, as at 12 December 2014, 18 Section 8(4) warrants covering interception with the assistance of ISPs and one covering GCHQ’s own interception operations.  The subsequent Anderson Report recorded 20 Section 8(4) warrants, as did the Interception of Communications Commissioner’s Annual Report as at 31 December 2014. 

The most fundamental question about Section 8(4) is whether a power to harvest communications in bulk and then fish for suspicious material in the resulting information pool should exist at all. 

The ISC report ([viii] and [70]) rejects any suggestion that Section 8(4) legitimises fishing expeditions (in the sense of analysts searching freely).  Certainly Section 8(4) does not, as the Interception Commissioner has said, permit random trawling of communications.  To continue the metaphor, RIPA places limits on what GCHQ can fish for in the pool and on the kinds of hook that it can use. But a Section 8(4) warrant is nonetheless a broad permit to go fishing for suspicious material in the pool of captured communications and associated communications data - a pool containing both external (at least one end outside the British Islands) and collaterally acquired internal (both ends within the British Islands) communications.

Since none of the three reviews has recommended abolition of bulk interception warrants and so far they have survived human rights challenges, it seems inevitable that they will be retained in some form in this autumn’s draft Bill.

However Section 8(4) has thrown up a raft of problems that are likely to be addressed in some way in the new Bill.

 

External communications. Section 8(4) is supposed to be about intercepting external communications – those where at least one end is outside the British Islands. Litigation in the IPT revealed, for the first time, that the Home Office had adopted a surprisingly broad interpretation of external communications. 

In any event the distinction between external and internal is unclear and increasingly arbitrary, particularly with mobile communications when it is often impossible to know whether the communication being intercepted is internal or external (see my submissions to Anderson at [31] to [54], cited in the Report at [12.25]).  This unsatisfactory situation is not, incidentally, an example of RIPA going out of date.  It was explained by the Home Office Minister in Parliament during passage of the Bill.

Section 8(4) allows internal communications to be swept up if, which is typically the case, they cannot be separated from external communications.  Once captured, internal and external communications form a single pool and are treated alike.  Limitations on selecting communications for examination rely on the location of the target at the time of selection, not on whether the communication was internal or external when it was sent or received.

The drafters of the new Bill will have to decide what to do about the internal/external communications divide.  The three reviews have made differing recommendations:

ISC	The Government must publish an explanation of which internet communications fall under which category, and ensure that this includes a clear and comprehensive list of communications. (Recommendation O)
Anderson	The existing distinction is outdated in the context of internet communications and should be abandoned (14.76) Instead, bulk interception warrants should be required to be targeted at the recovery of intercepted material comprising the communications of persons believed to be outside the UK at the time of those communications. If the recommendation for a self-standing bulk communications data warrant were to be accepted, consideration should be given to whether an analogous restriction is necessary or desirable. (Recommendation 44)
RUSI	No recommendation

Restrictions on targeting people within the UK assume greater significance in the light of the security agencies' suggestion to Anderson that they anticipate a need in future to apply GCHQ’s overseas bulk data analysis methods domestically:

"domestic security work will increasingly rely on the use of bulk data, including the examination of communications data within the UK. The spread of encryption and the multiplicity of identities used online by individuals mean that the kind of target search and discovery familiar from overseas operations will be needed in the domestic sphere.”  [10.24]

There could also be pressure to extend the use of such powers from the intelligence agencies to conventional law enforcement:

“There are still investigatory powers that only the security and intelligence agencies deploy: notably bulk data collection and CNE. I have not suggested that this should change. But as technology develops, bulk data analysis (notably by private companies) becomes a standard feature of everyday life and digital investigation techniques become more widespread, the trend may prove to be towards convergence rather than the reverse.” [13.42]

The Coming UK Surveillance Debate: Legal and policy origins

One of a series of posts on the forthcoming Investigatory Powers Bill

Previous: Red lines and no-go zones
Next: Bulk interception, Part 1

This autumn the UK government will publish its draft Investigatory Powers Bill for pre-legislative scrutiny by a Joint Parliamentary committee. The new legislation will replace the much criticised Regulation of Investigatory Powers Act (RIPA), which since 2000 has regulated the interception and communications data acquisition activities of law enforcement and the security and intelligence agencies. It will also revisit the communications data retention regime currently embodied in the Data Retention and Investigatory Powers Act 2014 (DRIPA).   

The new legislation will draw on three separate published reviews of investigatory powers by the Intelligence and Security Committee ofParliament, by the Independent Reviewer of Terrorism Legislation David Anderson Q.C. and by a Panel established by the Royal United Services Institute.  It will also have to take into account an accumulated body of adverse court and Investigatory Powers Tribunal decisions, a critical report by the Interception of Communications Commissioner and several pending challenges in the European Court of Human Rights.

In ‘Redlines and No-go zones’ I discussed how far the authorities should in principle be able to go in capturing, analysing and examining the content of our communications and associated communications data.  

Now we can look in our crystal ball and try to discern some of the specific content of the draft Bill, which I will do in a series of connected posts.

The issue that has so far occupied the headlines is whether to move from political to judicial authorisation of interception warrants. Anderson and the RUSI report have both come out in favour of some form of judicial approval system. The ISC report opted for continuing with Ministerial warrants.  

Whichever way the government jumps on judicial approval, the Bill is certain to feature improved oversight.  Independent oversight is desirable in its own right and necessary for human rights compliance.  However it is not a panacea.  A far reaching power may still be so repugnant as to cross a red line even if counterbalanced by oversight, safeguards and a Minister or judge’s belief that the exercise of the power is necessary and proportionate.

In this series of posts I will focus on the substantive scope of the powers rather than on oversight mechanisms.  The substantive powers are the most difficult and confusing area, yet lie at the heart of the legislation.

Two of the most hotly disputed existing powers are bulk interception warrants under section 8(4) of RIPA and mandatory retention of communications data by ISPs and internet companies under DRIPA.  Since none of the investigatory powers reviews has proposed abolishing either of these, it is a safe bet that despite continuing objections from privacy and civil liberties advocates both will reappear in some form unless a final human rights court ruling forces the government’s hand.

On that note, in July the English High Court ruled in favour of MPs David Davis and Tom Watson’s challenge to the communications data retention elements of DRIPA.  The court disapplied the provisions on three grounds of non-compliance with the EU Charter of Fundamental Rights, but deferred its order until March 2016 to enable the government to bring forward new legislation. The government has said it will appeal. The European Court of Human Rights is due to hear various Snowden-related challenges and the UK’s Investigatory Powers Tribunal has issued decisions adverse to the government which will influence some aspects of the Bill.

Several coalescing policy and legal channels will feed into the Bill.

-     Revived Communications Data Bill.  In June 2012 the coalition government published a draft Communications Data Bill, popularly dubbed the Snoopers Charter (a description contested by its supporters and some neutrals). The CDB would have significantly extended communications data retention obligations, would for the first time have required CSPs to generate specified types of communications data and to put in place specific communications data retention technical capabilities, and would have introduced a ‘request filter’ (a horizontal search facility across data retained by multiple providers).  Much of the substance of the CDB was to be delegated to secondary legislation and, a layer below that, to notices issued by the Secretary of State to communications providers and others.

It was said that the CDB was needed to plug a growing capability gap suffered by the investigatory authorities. The draft Bill and the evidence put forward in its support were roundly criticised by a Joint Parliamentary Committee in December 2012.  The CDB proceeded no further, other than the introduction of powers in the Counter-Terrorism and Security Act 2015 to mandate retention of so-called IP address resolution data.

Since the enactment of RIPA in 2000 the volume, frequency and richness of communications data has increased out of all recognition, particularly as a result of the ubiquity of mobile devices. Many argue that as a result the privacy implications of collecting and accessing communications data can be as great as for content. Certainly communications data can be at least as useful as content. The ISC Report notes the ISC's surprise at discovering that the primary value to GCHQ of bulk interception was “not in reading the actual content of communications, but in the information associated with those communications”. [80]

Home Secretary Theresa May said after the May 2015 general election that the government “would be giving the security agencies and law enforcement agencies the powers that they need to ensure they’re keeping up to date as people communicate with communications data” and that it intends to bring through the legislation that it was prevented from introducing during the Coalition. Just what that may mean in concrete terms is not yet clear, especially since there are hints in the Anderson Report that the security and law enforcement agencies may be pushing less strongly for some of the CDB powers.

-     DRIPA sunset.  In July 2014 the coalition government rushed the Data Protection and Investigatory Powers Act through Parliament in four days.  The main purposes of DRIPA were to reenact mandatory communications data retention in primary legislation following the CJEU’s invalidation of the EU Data Retention Directive, to expand (or as the government would have it ‘clarify’) the RIPA definition of telecommunications services and to give extraterritorial effect to RIPA’s interception and communications data acquisition powers.  

All these provisions, as well as the retention of IP address resolution data introduced by Section 21 of the Counter-Terrorism and Security Act 2015, expire on 31 December 2016. New legislation will have to be in place before then unless Parliament decides to defer the sunset date. The government said in July that it will publish a draft Bill in the autumn for pre-legislative scrutiny by a joint committee of Parliament and introduce the Bill into Parliament in the early part of 2016. 

The timetable has since been complicated by an earlier deadline of March 2016 for enacting EU Charter compliant communications data retention legislation set by the High Court decision in the Davis/Watson DRIPA judicial review proceedings. Whether that will be revisited on an appeal remains to be seen.

-     Journalistic privilege.  News broke in September and October 2014 that police had been using their RIPA communications data powers to access journalists’ data and identify their sources. This led to an inquiry and report by the Interception of Communications Commissioner published in February 2015, recommending that judicial authorisation must be obtained where communications data is sought to determine the source of journalistic information.  So far this has been addressed by a revision to the Communications Data Acquisition Code of Practice, laying down that applications to court under the Police and Criminal Evidence Act 1984 should be used until such time as there is specific legislation to provide judicial authorisation. The Bill can be expected to contain specific provisions. 

-     Invalidation of EU Data Retention Directive. In April 2014 the CJEU Digital Rights Ireland decision invalidated the EU Data Retention Directive.  That led in the UK to DRIPA and then to the so far successful court challenge to DRIPA by David Davis MP and Tom Watson MP. Any new legislation will have to comply with the DRI decision.  The closer to the wind the government chooses to sail in the Bill, the more vulnerable the new legislation will be to a further court challenge.  The Davis/Watson case will have brought home to the government that, unlike complaints under the Human Rights Act, a complaint of incompatibility with the EU Charter can result in primary UK legislation being disapplied.

-     Snowden fallout. The Snowden revelations spawned various challenges to surveillance and similar activities, both domestic and in complaints to the European Court of Human Rights.  The Investigatory Powers Tribunal found that there was a historic breach of ECHR Article 8 in respect of receipt of PRISM and (allegedly) UPSTREAM data from the NSA, since (prior to disclosure of internal GCHQ rules during the proceedings) there was no sufficiently clear and accessible law governing it.  The IPT proceedings also revealed a previously unknown government interpretation of RIPA. Indirectly Snowden gave rise to the three investigatory powers reviews and to general acceptance that more transparency, or at least translucency, will be required in the future.

-     Encryption Prime Minister David Cameron has criticised the use of encryption that law enforcement and intelligence agencies may not be able to break: "In extremis, it has been possible to read someone’s letter, to listen to someone’s call, to listen in on mobile communications, ... The question remains: are we going to allow a means of communications where it simply is not possible to do that? My answer to that question is: no, we must not."

Part III of RIPA already contains powers to require decryption of information by someone who has a key. However ISPs, platforms and consumer software providers often do not have, and never have had, an encryption key in their possession that could decrypt their customers’ communications.  

Mr Cameron says he believes in ‘very clear front doors through legal processes’ not ‘back doors’. Techies are hard put to understand the difference, pointing out that there is no such thing as a door through which only law enforcement can enter.  Where this may end up is anyone’s guess.

-     Intermediaries. In a related vein Mr Cameron said on 20 July that platforms and intermediaries should do more to help identify potential terrorists on their platforms, demanding that Silicon Valley should waveits technology magic wand to make it happen. Whether anything of this nature will find its way into the new legislation is unclear. Legislative action would face a formidable hurdle in Article 15 of the EU Electronic Commerce Directive, which prohibits Member States from imposing general monitoring obligations on conduits, caches and hosts.

According to taste Article 15 is either on outdated provision that should be revisited in the light of the advent of social media, or a prescient piece of legislation that foresaw the still relevant need to prevent Member State governments being tempted to use intermediaries as information choke points.