The tangled net of GCHQ’s fishing warrant

[Updated 8 February 2015 and 10 June 2015]

The Section 8(4) RIPA warrant is the most powerful interception tool available to UK intelligence agencies. While a targeted Section 8(1) warrant has to name a person or a set of premises, a section 8(4) warrant can authorise bulk interception of millions of simultaneous communications on an internet backbone.

Periodically renewed Section 8(4) warrants are thought to authorise GCHQ’s TEMPORA programme of tapping into transatlantic fibre optic cables, which reportedly processes 40 billion items of data per day.

Following the Snowden revelations a group of NGOs including Liberty, Privacy International  and Amnesty International challenged Section 8(4) in the Investigatory Powers Tribunal. The IPT found in December that, in the light of disclosures of interception practice made by the government in the proceedings, future use of Section 8(4) warrants would be ‘in accordance with the law’ under Article 8 of the European Convention on Human Rights. The legality of previous Section 8(4) interception has still to be determined. [Now held to have been lawful: IPT judgment 6 Feb 2015, para 12.]

The justification for the Section 8(4) warrant is that investigating terrorism and crime abroad is harder than domestically. It is said that a Section 8(4) warrant is primarily aimed at external communications (sent, received or both outside the British Islands) and not primarily at people located here; and that the purpose of accessing external communications is primarily to obtain information about people abroad. (IPT judgment, [145] and [147]).

But is the purpose of Section 8(4) to gain access to external communications? Or is it to gain access to the communications of people outside the British Islands? Is it a mixture of the two? Bearing in mind that people within the British Islands may send and receive external communications, the objectives are significantly different.

In fact Section 8(4) goes some way towards both objectives, but gives full effect to neither.  The result is a warrant with an avowed purpose to intercept external communications, but which in reality sweeps up both internal and external communications and then treats them identically. Or, if its purpose is to access communications of people outside the British Islands, it nevertheless allows some access to the communications of people within the British Islands.

These points are especially significant when it is appreciated that under Section 8(4) not only capture of communications but also their searchability does not depend on pre-existing grounds for suspicion. The bulk capture stage is suspicionless. Agencies trawling the intercepted material are then not confined to looking for activities of known suspects. The agencies can use keyword and other subject-matter searches to fish for new targets in the general pool of captured internal and external communications.  It is apt to describe Section 8(4) as a fishing warrant. 

This dual use of RIPA was confirmed by senior Home Office official Charles Farr in the IPT proceedings:

“Other information that is obtained via interception is used to identify other previously unknown communications of existing targets, and to identify new targets for investigation. Indeed, a significant proportion of initial intelligence leads derive from interception operations.” (emphasis added) (Farr witness statement, paragraph 31)

This article discusses how the Section 8(4) warrant implements the two avowed purposes and concludes with some observations on points for consideration in the forthcoming likely reform of RIPA.

How far is it the purpose of Section 8(4) to gain access to external communications?

A Section 8(4) warrant, like a targeted Section 8(1) warrant, has to be for a statutory purpose: national security, preventing or detecting serious crime or safeguarding the UK’s economic wellbeing (if relevant to national security).  These purposes govern all three stages of the Section 8(4) warrant structure: Capture, Select, Examine. The scheme is illustrated in this diagram:

The first stage, Capture, is the only point at which the internal/external communication distinction is relevant. In terms of the broader Section 8(4) legislative scheme the distinction plays no more than a fleeting introductory role. This has become more obvious following the judgment of the IPT.

Section 8(4) (in conjunction with Sections 8(5) and 5(6)) authorises “the interception of external communications in the course of their transmission by means of a telecommunication system”. However it also authorises “all such conduct (including the interception of communications not identified by the warrant) as it is necessary to undertake in order to do what is expressly authorised or required by the warrant”.

In other words, internal as well as external communications can be captured under a Section 8(4) warrant if they are unavoidably swept up in the interception process. 

On 4 July 2000 the government Minister Lord Bassam, in a letter to Lord Phillips during passage of the Bill, pointed out that:

“Clause 8(5) could, for example, make lawful the interception of internal communications where these mixed with external communications on a trunk used mainly for external purposes.”

In the House of Lords debate on the Bill on 12 July 2000 he said:

“It is still the intention that Clause 8(4) warrants should be aimed at external communications. Clause 8(5) limits such a warrant to authorising the interception of external communications together with whatever other conduct is necessary to achieve that external interception. Whenever such a warrant is signed, the Secretary of State must be convinced that the conduct it will authorise as a whole is proportionate—my favourite word—to the objects to be achieved. His decision to sign will be overseen by the Interception of Communications Commissioner.”

In the IPT proceedings Charles Farr said:

“Section 5(6)(a) makes clear that the conduct authorised by a section 8(4) warrant may in principle include the interception of communications which are not external communications insofar as that is necessary in order to intercept the external communications to which the warrant relates. But the primary purpose and object of any conduct authorised or required by a section 8(4) warrant must consist in the interception of external communications.” (witness statement, paragraph 155)

With this emphasis on external communications we might expect the distinction between internal and external communications to suffuse the whole of the Section 8(4) regime including the subsequent selection and examination stages. 

In fact, as can be seen from the IPT’s judgment, the distinction has no relevance at those stages:

“It is also common ground that the interception under a s.8(4) warrant (what the Respondents call “Stage one”) occurs before any question of selection for examination (what the Respondents call “Stage two”) arises under s.16. As Mr Ryder put it, the relevance of the internal/external distinction has no relation to the s.16 examination, when a communication may be accessed and read. The identification of communication links for interception is, as he described it, a ‘generic’ exercise, not an exercise which is done specifically case by case and communication by communication.” [95] (emphasis added)

The criteria that constrain selection and examination are different from internal/external communication.

The primacy that Section 8(4) accords to external communications at the capture stage is thus of limited significance.  External and internal communications are inseparable as they pass through a fibre optic cable. If the Secretary of State’s purpose is to capture external communications, and he has a basis for believing that the warrant will fulfil that purpose and is necessary and proportionate, Section 8(4) in practice authorises the capture of all communications passing through the cable whether internal or external. The captured communications, both internal and external, then form a common pool and are treated alike.

The limited significance of the external/internal distinction in the overall scheme of Section 8(4) can also be seen in the IPT’s discussion of the position if the Secretary of State had adopted an incorrect legal interpretation of ‘external communication’.

“…the distinction only arises at “Stage one”, when there is no examination:

i) All communications, whether they be external or internal, intercepted by s.8(4) warrant come to be considered for examination by reference to s.16 of RIPA, to which we turn below. It is that section which does what Mr Ryder called in argument the “heavy lifting”.” (emphasis in original) [101]

The IPT also referred to what it termed ‘inchoate’ external communications. This reflects the fact that in many cases the intercepting agency cannot know whether it is capturing an internal or an external communication. This is because the distinction depends on the location of the sender or recipient when the communication is sent or received respectively. For communications such as e-mails, the location of the recipient cannot be determined by looking at the communication or its related communications data.  The location of the mailbox may be ascertainable, but that cannot reveal the location of a person who picks up the message after the interception has taken place.

Lord Bassam recognised this for mobile roaming during the Parliamentary debate on the Bill:

“Even after interception, it may not be practicably possible to guarantee to filter out all internal messages. Messages may well be split into separate parts which are sent by different routes. Only some of these will contain the originator and the intended final recipient. Without this information it will not be possible to distinguish internal messages from external. In some cases it may not be possible even if this information is available. For example, a message between two foreign registered mobile phones, if both happened to be roaming in the UK, would be an internal communication, but there would be nothing in the message to indicate that.” (emphasis added) (Hansard, 12 July 2000)

The IPT judgment observed:

“It is inevitable that, when a telephone call is made from a mobile phone or IPhone, or an email is sent to an email address, it will not necessarily be known whether it will be received in the United Kingdom or in the course of travel or at a foreign destination. It is accepted that once and if received abroad by the intended recipient it will be an external communication, even if the sender did not know, when he or she made the call or sent the email, that that was to be the case.” [(94(iii)]

Selection and Examination – people outside the British Islands?

The Selection and Examination stages follow Capture. Examination is the point at which human analysts can read, look at or listen to captured material.  Although they are limited to examining material described in the Secretary of State’s certificate on the warrant, that description could be as wide as all communications between the UK and a named country, or passing through a particular cable.  

More significantly, analysts can (with some exceptions) only examine material that has been selected in ways that do not breach the Section 16(2) prohibitions. These are the provisions that do the ‘heavy lifting’ referred to by the IPT. Generally they reflect the second avowed purpose of Section 8(4) – to gain access to the communications of people outside the British Isles, but not those of people within the British Isles.

Lord Bassam, in the House of Lords debate on 12 July 2000, said:

“selection may not use factors which are referable to an individual known to be for the time being in the British Islands”

However RIPA is not that straightforward. Under Section 16(2) a selection factor is prohibited if it:

“(a) is referable to an individual who is known to be for the time being in the British Islands; and

(b) has as its purpose, or one of its purposes, the identification of material contained in communications sent by him, or intended for him.”

Lord Bassam’s summary reflects (a), but not the significant additional limitation in (b). This narrows the scope of the Section 16(2) prohibition, enabling at least one kind of search to be made using the name of someone known to be within the British Isles.  

Some examples illustrate the apparent effect of the Section 16(2) prohibitions. These apply whether the captured communications were internal or external.

-         An analyst could not (without a modification to the warrant) search for Joe Smith’s communications by (say) his e-mail address if he knows that Joe Smith is within the British Islands.  

-         If Joe Smith’s communication turns up in response to:

o   a subject matter search (e.g. ‘Syria’), not referable to any individual

o   a search using someone else’s name (not known to be within the British Islands) or the name of a corporation

o   a search for his own name within the body of someone else’s communication

o   a search for his own name aimed at finding his own communications, if the agency does not know that he is for the time being within the British Islands

then according to the letter of Section 16(2) it could apparently be examined.  (However if the examination itself involves a process of further selection, an analyst could be prohibited (without a warrant modification) from focusing on communications of someone known to be within the British Islands of which s/he becomes aware during examination.)

-         If Joe Smith has left the British Islands since sending the communication, then the analyst could apparently search using his name, since Joe Smith is no longer ‘for the time being’ within the British Islands

As to the last point, the IPT judgment could be read differently (para 143):

“Communications intercepted under a s.8(4) warrant cannot be read if sent by or to a person located in the UK, by reference to the s.16(2) procedure discussed at some length above.”

However that would not take account of ‘for the time being’, which on the face of it refers to the time of search, not the time of the communication.

This extract from the Foreign Secretary’s evidence to the Intelligence and Security Committee on 23 October 2014 also seems to conflate time of communication and time of search:

“The Foreign Secretary clarified after the meeting that, if a communication is intercepted under an s.8(4) warrant, and if one end is outside of the UK, it may be selected for examination without a 16(3) modification if the subject of interest is the non-UK end of the communication; however, if the subject of interest is the party in the UK, or if both ends are UK, there needs to be a 16(3) modification or 8(1) warrant authorised by the Secretary of State before it can be selected. He undertook to write to the Committee with further detail.”

Section 16 provides some limited gateways permitting examination even if the material was selected using factors prohibited by Section 16(2). 

The most potentially significant gateway is an additional certificate under Section 16(3). This allows otherwise prohibited examination if the Secretary of State certifies that selection by factors referable to the individual in question is necessary for national security, prevention or detection of serious crime, or national security-related UK economic wellbeing; and the material relates only to communications sent during a maximum period of three months (six months for national security). The extent to which Section 16(3) has been used is not public. 

There is also a procedure known as an ‘overlapping’ Section 8(1) targeted warrant. The procedure was first described in the Interception Commissioner’s Report for 1986 under the pre-RIPA interception regime. It appears that its purpose is to buttress the examination of communications to or from persons within the British Isles legitimately available for examination through the Section 8(4) procedure. However the procedure’s exact use and legal significance is unclear. The status of overlapping warrants and their relationship to Section 16(3) were issues during the passage of the Bill.

Reform of RIPA

Several reviews of RIPA are currently in progress. They include the Investigatory Powers Review by the Independent Reviewer of Terrorism Legislation under the Data Retention and Investigatory Powers Act 2014 (DRIPA), due to report by May 2015; the RUSI Independent Surveillance Review and an inquiry by the Intelligence and Security Committee of Parliament.

Reform of RIPA will be a priority after the 2015 General Election, with legislators mindful of the sunset date of 31 December 2016 for the RIPA amendments made by DRIPA. The pros and cons of Section 8(4) warrants will be hotly contested. Among the possibilities that we can anticipate being advocated may be:

-         Abolish all suspicionless bulk capture of communications.

-         Limit selection and examination under a Section 8(4) warrant to communications of pre-existing suspects.

-         Maintain the status quo.

-         Enact more extensive powers.

There will of course be debate around broader overarching issues such as whether it is any longer appropriate to treat communications data as deserving less privacy protection than content.

RIPA is notoriously difficult to understand.  The convoluted selection and examination provisions of Section 16 are among the most difficult to untangle. Whatever the eventual policy outcomes of the forthcoming debates, any new legislation should be clear, accessible and reflect the purposes for which it is enacted. 

The discussion above highlights some specific issues that are likely to have to be considered should Section 8(4) survive in any recognisable form.

Before commenting on these, one fundamental issue that will be relevant to any interception regime is hidden legal interpretations.

Hidden Legal Interpretations

Legal interpretations are critical to the operation of RIPA. An obvious example is the interpretation of ‘external communications’.  Others mentioned in this article include overlap of selection and examination, what constitutes an agency’s knowledge of someone’s whereabouts and whether it is bound to make enquiries, the relevance and extent of the various statutory purposes said to be embodied in the legislation, the significance of ‘for the time being’ in section 16(2) and the legal effect (if any) of overlapping warrants.  There have been other examples, such as extra-territoriality.

The agencies conduct their activities on the basis of legal interpretations of the legislation which generally remain hidden from view.  It took the extraordinary event of the Snowden disclosures for the government to reveal, in the resulting IPT proceedings, its particular (and widely criticised) interpretation of external communications.

It would be a significant step forward if the Interception Commissioner (or any future equivalent oversight body) were to be charged with publishing legal interpretations on the basis of which the agencies operate under interception legislation.

Turning to specific issues around Section 8(4):

Incidental awareness

Section 16(2) is structured as if selection and examination are separate phases. Yet if that were so, analysts would be able to examine and use material of which they became incidentally aware as a result of a permitted search, but which they could not legitimately have targeted directly. 

If while reading a communication selected by means of a permissible factor an analyst becomes interested in its sender or recipient, and that person is known to be within the British Isles, does that amount to selection? Does Section 16 then prohibit further examination without a modification to the warrant? This ought to be the case, and may be supported by para 105 of the IPT judgment, but is less than clear on the face of the statute.

This kind of issue may be covered in internal intelligence agency guidance documents.  It ought to be specifically and clearly addressed in legislation. It also may bear on the use of overlapping Section 8(1) warrants.

Internal/external communications

Warrants to intercept external communications go back to Section 4 of the Official Secrets Act 1920, which used the same definition of external communications as does Section 8(4). However the distinction now has limited significance in the overall scheme of Section 8(4) warrants. It is also curious that Parliament should have knowingly hung Section 8(4) on the slender thread of something largely unascertainable.

That is not to say that the distinction has no constraining effect on the initial interception stage. For instance, could a Secretary of State sign a Section 8(4) warrant to tap a domestic cable carrying 99% internal communications if his primary purpose and object was genuinely to capture some of the 1% external communications?

The Secretary of State would have to consider whether the warrant was necessary and proportionate, including in particular whether the information thought necessary to obtain under the warrant could reasonably be obtained by other means (Section 5(4)). Such considerations, and the requirement to certify a description of intercepted material considered necessary to be examined, ought to drive a Secretary of State towards directing Section 8(4) warrants at cables that are most likely to contain the highest proportion of external communications.  That approach is borne out by Charles Farr’s witness statement in the IPT proceedings (para 154):

“Thus, when conducting interception under a section 8(4) warrant, knowledge of the way in which communications are routed over the internet is combined with regular surveys of internet traffic to identify those bearers that are most likely to contain external communications that will meet the descriptions of material certified by the Secretary of State under section 8(4)(b)(i) of RIPA. While this approach may lead to the interception of some communications that are not external, section 8(4) operations are conducted in a way that keeps this to the minimum necessary to achieve the objective of intercepting wanted external communications.”

While broad considerations of necessity and proportionality give some comfort, they are not the most concrete of protections.  If Section 8(4) were to survive in anything like its current form, consideration might be given to, for instance, explicitly restricting it to international cables.

If it remained an avowed purpose of a Section 8(4) replacement to focus on interception of external communications, then consideration could be given to extending that beyond the capture stage. The agency could be required (to the extent feasible) to sift out and discard internal communications after capture. It could be required to cease examining a communication that it realised was internal. If a selection/examination distinction based on a person's location within or outside the British Islands were to be retained, then the scope for examining communications of people within the British Islands would bear reconsideration .  

Knowledge of location of a person

The prohibited Section 16(2) selection factors refer to an individual ‘known’ to be within the British Isles.  The agency is therefore on the face of it free to search for the communications of someone whose whereabouts are unknown, or if it suspects but does not know that the individual is within the British Isles (IPT judgment, [104] - [105]).

‘Known’ presumably means known to the agency.  Does that mean known to the particular analyst responsible for setting the selector, known to a group of analysts, or include anything in the records and archives of the agency?

Does it include information within the intercept material itself? One would assume not, since the agency could never safely set a name selector to search the pool of intercept material if it was deemed to know everything within it.

However there is a relevant difference between content and related communications data captured under a Section 8(4) warrant.  The section 16(2) restrictions do not apply to the related communications data.

The government argued before the IPT that this was justified by the use of related communications data in order to determine whether someone was for the time being within the British Isles. This was necessary in order for the safeguard in Section 16(2)(a) to work properly:

“In other words, an important reason why the Intelligence Services need access to related communications data under the s.8(4) Regime is precisely so as to ensure that the s. 16 safeguard works properly and, insofar as possible, factors are not used at the selection that are - albeit not to the knowledge of the Intelligence Services - “referable to an individual who is ... for the time being in the British Islands”.” [112]

The government submitted that this was plainly the express, and sensible, purpose of Parliament.

The government argument seems implicitly to posit some duty on the agency to enquire into the location of a selection target, albeit that is not spelt out in Section 16.

The IPT accepted that the different treatment of communications data

“is justified and proportionate by virtue of the use of that communications data for the purpose of identifying the individuals whose intercepted material is to be protected by reference to s.16(2)(a).”[114]

The IPT rejected the NGOs’ argument that use of communications data for this purpose could be addressed by an exception in the legislation, saying that it was an “impossibly complicated or convoluted course”. That issue could be revisited in any reform of RIPA.

[Updated 2 Jan 2015 15.30 with additional reference to certificates; and 23.30 to substitute British Islands for British Isles (thanks to @RichGreenhill for pointing that out; and 3 Jan 2015 15:11 to add reference to RIP Bill debate on S16(3)/overlapping warrants.); and 8 February 2015 to add reference to further IPT judgment; and 10 June 2015 to add references to Sections 8(5) and 5(6).]

A Cheltenham Carol

On the Twelfth Day of Christmas my true love sent to me:

Twelve Zettabytes

Eleven Encryption Layers

Ten Coders Coding

Nine Hackers Hacking

Eight Routers Routing

Seven Inspected Packets

Six Spies-a-Spying

Five Back Doors

Four Fishing Warrants

Three Haystacks

Two Secret Laws

And a Paean to Proportionality

Another round of data retention

[Updated 4 December 2014]
[Further updated 20 January 2015 to add tweet.]
[Also updated 5 January 2015 with this brief commentary on the Home Office Factsheet:

Page 1: Top Lines

"IP resolution is the ability to identify who in the real world was using an Internet IP address at a given point in time." Data retention at best identifies the device or connection being used and any associated subscriber details. The subscriber is not necessarily the user. Page 2 of the Factsheet is accurate: "This data can help identify who has made a communication, when, where and how." (emphasis added) 

Page 1: Background

"However, some IP addresses are shared and allocated dynamically." True, but dynamic allocation is not what Clause 17 is about. Dynamic IP address allocation is sequential temporary allocation of a public IP address to one customer after another. Dynamic IP addresses are already explicitly mentioned in the DRIPA datatypes (Data Retention Regulations 2014, Schedule, Paras 13(1)(b) and 11(3)). It is evident from the diagram on page 3 of the Factsheet that the problem being addressed by Clause 17 is simultaneous sharing of a single public IP address by multiple ISP customers. 

Page 3 : Diagram

"At 4pm 2,500 people are using a single IP address on the internet." Exactly. The issue is simultaneous sharing of a single IP address, not dynamic (sequential) allocation of an IP address. 

"The e-mail service provider now provides police with IP address and port number used to send the e-mail and accurate time."  In order to do this the e-mail service provider in the diagram example will have had to retain IP address, port number and timing data.  Will such providers, as well as internet access providers, be subject to mandatory retention?

"Police seek details from internet access provider. Internet access provider now identifies the individual using the unique combination of IP address and port number provided at 4pm." The internet access provider identifies the customer, who may be but is not necessarily the individual who used the device in question.] 

Four months after DRIPA and 18 months after putting down a marker in the May 2013 Queen’s Speech, the UK government has embarked on a new round of legislation for mandatory retention of communications data. This time it is under the banner of IP address matching.

The Counter-Terrorism and Security Bill had its Second Reading yesterday and is expected to go into Committee on 9 December. Clause 17 will extend DRIPA to new categories of communications data.

DRIPA’s existing data retention obligations, rushed through Parliament in four days in July, are of course controversial. They are the subject of a threatened legal challenge by David Davis MP and Tom Watson MP.  The proposal to add IP address matching dates back to a recommendation of the Joint Committee on the draft CommunicationsData Bill in December 2012.

What new categories of communications data would have to be retained?

Clause 17, like so much UK legislation in this field, is difficult to understand. The Explanatory Notes and the Impact Assessments are more detailed, but still confusing. (The Home Office has subsequently issued a Factsheet.) MPs suggested in the Second Reading that the drafting of Clause 17 needs to be examined critically.  They are right.

The overall aim seems to be to mandate retention of data that can link a given communication made via a simultaneously shared public IP address to one of many devices or connections that may have been using that IP address at a given time.  Clause 17 labels this “relevant internet data”. We might call it linking data.

This appears to break down something along the following lines (the first two of these are illustrated in the useful diagram in the Home Office Factsheet).

• Some ISP and mobile operator systems don’t allocate one public IP address to one customer device or connection, but have many customers sharing an IP address simultaneously. They could be required to retain linking data such as port numbers.
• Even if an ISP retains IP address and (say) port number records, it cannot be sure of identifying a single device or connection unless law enforcement can provide it with a both a port number and an IP address to look up. So a cloud storage or web e-mail provider accessed by the user could also be required to retain logs of linking data visible to it, such as port numbers.
• Operators such as public Wi-Fi hotspots could be required to log MAC addresses.

Weblog data (records of websites accessed by customers) would be excluded from mandatory retention by internet access providers such as ISPs and mobile operators.

The Overarching Impact Assessment provides this summary:

“IP Resolution: Allow for a power to require communications service providers to retain the data necessary to attribute an IP address to an individual.”

Taken literally, that is a power to require the impossible. We don’t have IP addresses tattooed on our foreheads. Even if we did that would not identify us, as opposed to someone else, as the user of the device at any given time. An IP address at best identifies a device or a connection. The ISP may then be able to link that with the identity of its subscriber customer, but no more. The subscriber may or may or not be the user. The Factsheet diagram, unfortunately, perpetuates the myth that an IP address identifies a user.

DRIPA in fact already covers retention of subscriber data for IP addresses (both where the IP address is static and where it is dynamically allocated in sequence to different customer devices and connections). What it doesn’t cover is the single public IP address simultaneously shared among many of an ISP’s customers.

The Bill is meant to be only about IP address matching. So it is not immediately obvious why the Impact Assessments say that the Bill will expand DRIPA to cover a wider range of internet services. On the other hand Clause 17 does not seem to do this, since it only amends the categories of data to be retained. DRIPA has already adopted an extremely broad underlying definition of telecommunication services.

The new obligations would be subject to the same 31 December 2016 sunset clause as DRIPA. As with DRIPA itself, mandatory retention will apply only to data generated or processed in the UK by public providers in the process of providing the telecommunications services concerned; and then only to those on whom the government serves a notice. The Impact Assessment says that the service providers most likely to be affected by the Bill have been consulted.

That is my current stab at what Clause 17 is trying to do.  However it is a puzzling piece of drafting. Here are some questions worth considering.

What is ‘relevant internet data’?

Clause 17(3)(b) defines this as communications data relating to an internet access service or an internet communications service which:

“may be used to identify, or assist in identifying, which internet protocol address, or other identifier, belongs to the sender or recipient of a communication (whether or not a person)”.

This is the most curious part of Clause 17. The problem is surely not identifying which IP address ‘belongs’ to a given sender or recipient of the communication, but identifying which device or connection (of many) was used to make a given communication via a given shared public IP address. Is it drafted the wrong way round?

What is an ‘identifier’?

The Clause says that “identifier” means “an identifier used to facilitate the transmission of a communication”.  More helpfully, Clause 17(3)(b) tells us that an IP address is an identifier. The Explanatory Notes seem to conflate linking data and the shared identifier that we are trying to tie to a device or connection:

“…  An IP address can often be shared by hundreds of people at once – in order to resolve an IP address to an individual other data ("other identifier" in this clause) would be required.”

Whatever the ‘other data’ may be, surely it is not the ‘other identifier’ in Clause 17(3)(b)?

What else might be covered by ‘identifier’? A MAC address, although it operates at a lower (physical) layer than an IP address, would seem to qualify. But Clause 17 is not avowedly about retention of new categories of identifiers, only retention of data capable of linking shared identifiers (such as IP addresses) to an individual device or connection. If a MAC address is itself an identifier, does that prevent it being linking data? The Explanatory Notes suggest that a MAC address could also be linking data:

“Data necessary for the resolution of IP addresses could include port numbers or MAC (media access control) addresses.”

Are there circumstances in which a MAC address could be used to identify the particular device that sent a communication via a shared IP address? Public Wi-Fi hotspots seem a likely candidate. However a MAC address would presumably be less useful than a port number, assuming that the MAC address is not visible from outside the hotspot and so could not be logged at the other end of the communication.

What are an internet access service and an internet communications service? 

These are the foundation stones of Clause 17. Communications data cannot be required to be retained unless it relates to an internet access service or an internet communications service. These terms are also critical to the scope of the weblog data exclusion. Many will be surprised, therefore, to find that neither term is defined.

What do the terms mean? The glib answer is ‘whatever they meant in the EU Data Retention Directive’. That is their origin. They were used (but not defined) in the Directive.

The 2009 Data Retention Regulations, which implemented the Directive, followed its terminology. When the Directive was invalidated DRIPA re-enacted the datatypes that were in the Schedule to the 2009 Regulations. So the 2014Data Retention Regulations that were made under DRIPA again used the two terms, notably in the definition of ‘User ID’: “a unique identifier allocated to persons when they subscribe to, or register with, an internet access service or internet communications service.” Perhaps unsurprisingly given the government’s commitment to re-enact the 2009 datatypes identically, the 2014 Regulations again left the terms undefined. 

That is a plausible historical reason why the terms have been left undefined in Clause 17. But even though there is a breadcrumb trail back to the Directive, the lack of definitions in the Directive means that uncertainty remains particularly over ‘internet communications service’. Does it relate to any type of communication, or is it more limited, for instance to e-mail, messaging or telephony providers? The diagram in the Factsheet uses the example of an e-mail provider. However the Impact Assessment suggests that the government believes it has a broad meaning, covering for instance cloud storage services:

“For example w[h]ere a user uploads an illicit file to a cloud server that server provider, if subject to a data retention notice, would be required to retain sufficient information to enable the internet access provider to identify the user.”

We look forward to illumination of these and no doubt other points as the Bill proceeds. Meanwhile, the bigger question of whether any of this is compatible with the European Convention on Human Rights and the EU Charter of Fundamental Rights remains to be fought out. 

[My 8 point tweet of points on Clause 17:

1/8 Is it about dynamic (sequential) IP address allocation? No. Already covered in DRIPA and so excluded from Cl 17.
— Graham Smith (@cyberleagle) January 20, 2015

2/8 The Home Office Factsheet suggests Cl 17 is about simultaneous use of one public IP address by many customers.
— Graham Smith (@cyberleagle) January 20, 2015

3/8 But you'd never guess that from reading Cl 17. What else might it cover? Its vague drafting gives little clue.
— Graham Smith (@cyberleagle) January 20, 2015

4/8 The Fact Sheet shows it is meant to cover not just internet access, but cloud/web e-mail providers who generate or process data in UK.
— Graham Smith (@cyberleagle) January 20, 2015

5/8 Cl 17 isn't limited to data linking a device or connection to a public IP address. Includes 'other identifiers' as well as IP addresses.
— Graham Smith (@cyberleagle) January 20, 2015

6/8 What is an 'other identifier'? A MAC address, said the Minister on 9 Dec. The EN seems to suggest a MAC address is linking data. Both?
— Graham Smith (@cyberleagle) January 20, 2015

7/8 'Other identifier' is said to 'future proof' Cl 17 by making it 'technologically neutral'. In a provision sunsetted in Dec 2016?
— Graham Smith (@cyberleagle) January 20, 2015

8/8 RIPA was drafted to be technologically neutral. The result was a statute universally acknowledged to be impenetrable. #BeenHereBefore
— Graham Smith (@cyberleagle) January 20, 2015

[Updated 4 December 2014 with references to the Home Office Factsheet and minor clarifications and edits. Further update 5 January 2015 with comments on the Home Office Factsheet. Further updated 20 January 2015 to add tweet.]

Of straws and haystacks

Much post-Snowden attention has been directed to GCHQ’s TEMPORA programme, authorised (so it is thought) by a rolling series of external interception warrants under section 8(4) of RIPA. (See foot of this post for an explanation of Section 8(4) warrants and the restrictions, particularly for communications of persons within the British Isles, on their use.)

TEMPORA captures communications in bulk from transatlantic fibre optic cables, then filters them by computer leaving a residue of sifted material that GCHQ and NSA analysts can examine. It is said to process 40 billion items a day.

The often repeated justification for bulk collection and sifting is that we have no method of identifying and separating individual communications at the point of collection, so we must gather the straws and sift the resulting haystack. The usual metaphor is looking for needles, implying objective distinctions. It may be better to think of looking for straws.

What kind of straws can be looked for? The haystack can, within the restrictions laid down by RIPA, be sifted to detect the straws of pre-existing persons of interest. However Section 8(4) warrants go beyond that.  The captured material can also be searched and analysed to form new suspicions.   Home Office official Charles Farr said of RIPA in his witness statement in the current Investigatory Powers Tribunal proceedings:

“Other information that is obtained via interception is used to identify other previously unknown communications of existing targets, and to identify new targets for investigation. Indeed, a significant proportion of initial intelligence leads derive from interception operations.” (emphasis added)

We do not know what proportion of initial leads are false positives, casting suspicion on blameless people. We do not know how many true positives the system misses. Moreover suspicion is a highly subjective matter.

History suggests that general collection and subject matter analysis was an established approach to external communications long before today’s separation problems arose.

The ancestor of RIPA Section 8(4) was Section 4 of the Official Secrets Act 1920, legislated in the immediate aftermath of the First World War following the lapsing of wartime powers.  It empowered the Secretary of State to issue a warrant requiring a telegraph operator to hand over telegrams entering or leaving the country:

“Where it appears to a Secretary of State that such a course is expedient in the public interest, he may, by warrant under his hand, require any person who owns or controls any telegraphic cable or wire, or any apparatus for wireless telegraphy, used for the sending or receipt of telegrams to or from any place out of the United Kingdom, to produce to him, or to any person named in the warrant, the originals and transcripts, either of all telegrams, or of telegrams of any specified class or description, or of telegrams sent from or addressed to any specified person or place, sent or received to or from any place out of the United Kingdom by means of any such cable, wire, or apparatus, and all other papers relating to any such telegram as aforesaid.”

The Attorney General Sir Gordon Hewart introduced the provision in Parliament as a measure for detecting foreign spies:

“The postal and cable censorship which we had during the War, and which was of the greatest possible value and importance, was removed shortly after the Armistice. That being so, it is necessary that there should be power at least to compel the production of the originals and the transcripts of certain telegrams. It is not a power to stop telegrams. It is merely a power to compel the production of the originals and transcripts sent to, or received from, any place out of the United Kingdom; and the main purpose of that provision is to enable the authorities to detect and deal with attempts at spying by foreign agents.”

Earl Winterton invoked a familiar mix of foreign threats and ‘nothing to hide, nothing to fear’:   

“Everyone knows we do not live in ordinary times. Everyone knows there are plots and conspiracies against this Realm which are being carried out in foreign countries and some parts of the British Empire, and that, however one may dislike the idea of imposing additional restrictions on the subject, it is necessary for the Government to have that power. I suggest there is nothing to interfere with a person going about his legitimate business. The right hon. Gentleman, for example, made great play with Clause 4 of the Bill. … Surely he does not suggest that in the critical time in which we are living to-day a Secretary of State should not have power, if it seem desirable in the opinion of the Government that he should exercise that power, to find out what is being cabled to and from this country. Of course, it is a most necessary power, which every government ought to have.”

John Thorpe MP put the State firmly ahead of the individual:

“… In my view the State is in great danger, and no power which would tend to protect it should be withheld from the Government. We heard something from the same right hon. Gentleman of the liberty of the subject. In my view, the subject has no liberty when it is in conflict with the good-being of the State. When the liberty of the individual conflicts in any way with the well-being of the State, then it becomes license.  

… The law-abiding citizen, the man who says that his country is his first consideration, need have nothing to fear whatever from the Clauses of this Bill. … The only man who has anything to fear is the man who puts self before country, the man who says, "I want liberty, and the State can look after itself." He is a danger, and I congratulate the Government on the efficient manner in which they propose to deal with him.”

The legislation duly passed. For nearly 50 years Section 4 did its work in obscurity. The 1957 Birkett Inquiry into interception of communications did not mention it. (The Birkett Committee’s terms of reference were limited to the executive power to intercept, which was different and separate from the statutory power to issue warrants under Section 4.)

Things changed in February 1967.  Section 4 came to public notice when journalist Chapman Pincher revealed in the Daily Express that cablegrams sent out of Britain were being collected from the Post Office and private cable companies for scrutiny. This incident is most famous for sparking the ensuing D-Notice row. But the substance of Pincher’s ‘Cable Vetting Sensation’ story is of interest here. He revealed that:

“There is no hold-up or censorship of the cables. But on the morning after they have been sent or received they are collected and sifted by a Post Office department concerned with security. Then any cables believed to be of special interest are passed to the Security Services. 

They are studied there, copied if necessary, and returned to the Post Office and cable offices after being held for 48 hours. 

Most of the original cables and telegrams go out through the Post Office, which owns the former Cable and Wireless Company. Cables passed through private companies—mainly branches of foreign concerns operating in Britain—are collected in vans or cars each morning and taken to the Post Office security department. 

The probe is conducted under a special warrant, signed by a Secretary of State under Section 4 of the Official Secrets Act and regularly renewed to keep it valid.”

A week later Alan Watkins in the Spectator wrote:

“Indeed, sources confirm that a Ministry of Works van regularly takes cables—it is not clear whether they form a random sample, or come from a particular sender or class of senders—along to the Ministry of Defence for examination. The authority for such action is section 4(1) of the Official Secrets Act, 1920.”

The Radcliffe Report on the D-Notice affair confirmed the substantial accuracy of Pincher’s story:

“It does involve a regular collection of copies of messages transmitted by the Post Office and other cable offices with a view to the total collected being sorted and certain defined categories of them being set aside for inspection by the intelligence agents of Her Majesty’s Government. … 

The practice is authorised in law by section 4 of the Official Secrets Act, 1920 … . According to the information given to us, this power has been regularly exercised against transmitting companies since the coming into operation of the Act. … 

In fact only a small percentage of the total telegrams handled is put aside [by the sorters for inspection]. … The Daily Express article was … not inaccurate in any sense that could expose it to hostile criticism on that score.”

The Government White Paper published simultaneously with the Radcliffe Report said it would be contrary to the public interest to say in what detailed respects the article was misleading. It also said:

“It was precisely because national security was threatened that, from the outset, the Government regarded the publication of certain information in the Daily Express of 21 February as a matter of the utmost gravity. … It is the duty of the government, in the light of all the advice they have received and the information they possess, to record that the effect on national security of that publication has been to cause damage, potentially grave, the consequences of which cannot even now be fully assessed.”

The White Paper complained that the article created:

“the sensational impression that the Government were responsible for introducing new and sinister procedures.  There were, and are, no such new and sinister procedures. The activities involve no element of prying into the private affairs of the citizen. Such activities are, in fact, carefully controlled and confined and the article was misleading when it inferred the Government might use them improperly.”

Although the government denied (supported by the Report) that any new practice had recently been introduced, the possibility that routine vetting was a long established practice was left open.

Several themes from this episode resonate today:

• Bulk collection, sifting and examination
• Periodically renewed warrants
• Revelations about the extent of use of powers, answered by denials that the powers are abused
• Assertions, to be taken on trust, that publicity has caused damage to national security
• Intrusion into privacy rebutted on the basis of close control over the intrusion
• Bulk collection defended on the basis that only a small percentage of the items collected is inspected

Like the 1957 Birkett Report, the Home Office and Diplock Interception Reports of 1980 and 1981 made no mention of the Section 4 powers.  The reports were limited to statistical information about non-statutory warrants.  

The reports recognised the invasion of privacy involved in interception warrants. Lord Diplock said:

“The exercise by the State of any power to read or listen to communications taking place between private citizens involves an invasion of their privacy which has always been looked upon by the public with suspicion and distaste.”

The 1920 powers lasted until 1985, when they were replaced by the Interception of Communications Act (IOCA). The preceding White Paper had promised that the legislation would include provisions “along the lines currently covered by the Official Secrets Act 1920.” Whilst IOCA folded interception of external communications into the new statutory system for issuing warrants, the warrantry power for external communications continued to be broader than for internal communications.

So what is now the Section 8(4) warrant trod its own quiet path from 1920 to 1985, exposed to public scrutiny only once as a result of the Chapman Pincher cable vetting story – to which the Government of the day reacted almost identically as did the government of today to Edward Snowden’s TEMPORA disclosures.

A vanload of cables is on a smaller scale than 40 billion items of data per day, but the principle and method is the same: general capture, selection, examination. Long before any technical argument that targeted interception is impossible, the 1920 legislation enabled the government to engage in suspicionless bulk capture followed by subject-matter analysis of external communications.

In Chapman Pincher’s day collected telegrams and cables were evidently sorted manually. Human beings looked at them all and decided which were worthy of further examination. Now the initial capture, sift and discard is computerised.  The government argues that capture involves only a technical interference with privacy compared with a human being examining intercept material:

"The Respondents accept that the interception of a communication under a s. 8(4) warrant may be regarded as giving rise to a technical interference with the Art. 8 rights of the parties to the communication even if that communication is not and/or cannot be read, looked at or listened to by any person." (Open Response, IPT proceedings)

Going back further than 1920, in 1765 Lord Camden, the judge in Entick v Carrington, held that general search warrants had no legal basis. It is perhaps idle to speculate how he might have reacted had Lord Halifax (the then Secretary of State) said:

“Fear not, Mr Entick.  True we have ransacked your home, broken the locks on your desks and cupboards and seized your papers and correspondence.  But, since we have not yet examined any of them, that is a merely technical breach of privacy.  We have strict safeguards in place to ensure that we will only look for material about that renegade Wilkes who is outside the British Isles, skulking in Paris.”

Footnote: How does a Section 8(4) warrant work?

The Foreign Secretary can issue a RIPA warrant for purposes of national security; for preventing or detecting serious crime; for safeguarding the economic well-being of the United Kingdom (if related to national security); or, in relation to serious crime, mutual legal assistance treaties with other countries. He must believe the warranted interception and disclosure to be proportionate to what it seeks to achieve; and must take into account whether the information he thinks it necessary to obtain could reasonably be obtained by other means.

A Section 8(4) warrant, unlike an ordinary RIPA Section 8(1) warrant, does not have to be targeted at the communications of a particular person or premises. It can authorise general bulk collection at the level of the cable. But while a targeted Section 8(1) warrant can be used to intercept internal communications (those sent and received within the British Isles), the overall purpose of a Section 8(4) warrant must be the collection of external communications (sent or received outside the British Isles). So external communications are those where both ends of the communication, or only one end, are outside the British Isles.

Internal and external communications tend to be inseparably mingled within a single fibre-optic cable. So RIPA allows a S.8(4) warrant to authorise the capture not only of external communications, but any internal communications unavoidably swept up with them.

After capture of the communications come selection and examination. RIPA constrains these in different ways.

Captured communications (whether internal or external) can be examined if they are within a description certified by the Secretary of State in the warrant. That description could be very broad. However they can be selected for examination only in a way permitted by RIPA’s selection rules. These govern the automated filtering down of the captured communications to a database of material and also the queries made by analysts against the database.

The rules restrict the use of selection factors targeting the communications of people known for the time being to be in the British Isles. But despite this there are several gateways via which a communication sent or received by someone in the British Isles and captured under a S8(4) warrant could end up being examined by a GCHQ analyst.

Foreign Secretary Philip Hammond touched on two of the gateways in a clarification of his recent evidence to the Intelligence and Security Committee of Parliament. He posited a communication (say an e-mail) between someone in the British Isles and someone abroad. In general terms it could not be selected where the subject of interest is the person in the British Isles. That would require a further step such as the Secretary of State’s modification of the S.8(4) warrant under the exception in RIPA S.16(3). However the e-mail could be selected for examination if the person outside the British Isles is the subject of interest.

A Catechism of Privacy

Q. What is the State’s duty?

A. To protect us.

Q. How does the State protect us?

A. Through watchfulness.

Q. Whom does the State watch?

A. All who present a threat.

Q. Who watches the State?

A. We do.

Q. What may we see?

A. That which the State, which is wise, permits.

Q. May the State watch us?

A. We have nothing to hide.

Q. Must we obey the State?

A. The law must be observed.

Q. Does the State obey the law?

A. The State acts as necessary and proportionate in accordance with the law.

Q. Does the law protect privacy?

A. Privacy is not absolute.

  

Q. Should we fear the State?

A. The servants of the State are conscientious and dedicated.

Q. What does the State require of us? 

A. That we obey the law and act responsibly.

Q. What is our responsibility?

A. To enable the State to perform its duty.

Q. What is the State’s duty?

A. To protect us.

Submissions to the Investigatory Powers Review

[Update 11 June 2015.  David Anderson's report 'A Question of Trust' has been published today and is available on his website, together with two volumes of submissions made to his review. My own submission is also available here (PDF).]

David Anderson QC (@terrorwatchdog) is the UK's Independent Reviewer of Terrorism Legislation. He is tasked under the Data Retention and Investigatory Powers Act 2014 (DRIPA) with conducting a review of investigatory powers. This includes interception of communications (e.g. by GCHQ and law enforcement) and powers to compel retention and production of communications data. His Call for Evidence closed on 3 October 2014.  Here are some of the submissions to the Review now being made public.

AccessNow

Bingham Centre for the Rule of Law

Centre for Democracy and Technology

Dr Andrew Defty and Professor Hugh Bochel (University of Lincoln)

Equality and Human Rights Commission

Global Network Initiative

Human Rights Watch

Interception of Communications Commissioner

ISPA

The Law Society of England and Wales

Liberty

The Newspaper Society

UCL LLM Students

Vodafone

And although not strictly speaking a submission to the Review, GCHQ Director Sir Iain Lobban's valedictory speech.

More to follow.

Whose domain space is it anyway?

Governments shouldn’t get in the way of the people who run the internet. Fine sentiments reported by the Guardian from UK Culture Minister Ed Vaizey at the Internet Governance Forum in Istanbul this week.  They echo his speech to the ICANN meeting in London in June: "What governments shouldn’t be doing is attempting to manage how the internet is run."

Fine sentiments, but does the UK government live up to them?

Regrettably the UK government has not been immune from the temptation to take powers over internet governance institutions.  Sections 19 to 21 of the Digital Economy Act 2010 gave it power to take direct control of the .uk domain by putting a manager into Nominet.  The sections have not been brought into force, let alone the powers exercised.  But the government hardly needs to once the potential exists.

In the current interstate tug-of-war over global internet governance every State accuses every other State of donning fig leaves to conceal self-interest.  Here is an opportunity for the UK government to plant a flag in the high ground, to say ‘We mean what we say.  We have backed off, how about you?’

So make the bold move, repeal Sections 19 to 21 and issue the challenge. 

Or would the government backpedal? We can hear it now. “Reserve powers, only to be deployed in the last resort in the interests of UK plc, the Secretary of State cannot use them unless there is a serious failure in limited circumstances…” (See here the reasons put forward at the time the powers were legislated). 

That won't wash.  If failings are for a national government, not the internet governance community to sort out then fine sentiments are just so much vapour.  Letting go of powers is more than desirable, it is a litmus test.