The government has launched a consultation on codes of
practice covering the implementation of its controversial
communications surveillance laws.
The Regulation of Investigatory Powers Act’s Chapter II of Part
I gives a broad swathe of public authorities powers to demand
access to citizens' communications data, such as who they called or
e-mailed, and when.
Part III of the act gives the police powers to demand encryption
keys from individuals and businesses.
The legislation has been deeply controversial. Alongside the
concerns of privacy campaigners, internet service providers have
raised fears that the extra costs of storing huge amounts of data
on users’ communications to comply with the Chapter II requirements
could drive them out of business.
Security specialists have warned that Part III poses major
practical difficulties for banks and other businesses that use
encrypted communications, particularly where temporary session keys
are used to transmit data.
The Home Office has published draft codes of practice for both
sections of the act and opened a 12-week consultation period.
It said the code covering Chapter II had been refined since an
earlier draft two years ago to take account of current practice,
fill gaps where the original draft had offered insufficient
guidance, reduce unnecessary bureaucracy and address parliamentary
concerns over data protection.
The Part III measures on encryption keys have not yet been
implemented because the development and adoption of encryption and
other information protection technologies “has been slower than was
anticipated when the Act was passed” the second consultation paper
says.
It adds that investigators tackling crime and terrorism “have
begun encountering encrypted and protected data with increasing
frequency”.
This, and the rapidly growing availability of encryption
products including integrated security features in operating
systems, “has led the government to judge that it is now timely to
implement the provisions of Part III”.
Comments on the two draft codes are invited by 30 August.