The government has launched a consultation on codes of practice covering the implementation of its controversial communications surveillance laws.
The Regulation of Investigatory Powers Act’s Chapter II of Part I gives a broad swathe of public authorities powers to demand access to citizens' communications data, such as who they called or e-mailed, and when.
Part III of the act gives the police powers to demand encryption keys from individuals and businesses.
The legislation has been deeply controversial. Alongside the concerns of privacy campaigners, internet service providers have raised fears that the extra costs of storing huge amounts of data on users’ communications to comply with the Chapter II requirements could drive them out of business.
Security specialists have warned that Part III poses major practical difficulties for banks and other businesses that use encrypted communications, particularly where temporary session keys are used to transmit data.
The Home Office has published draft codes of practice for both sections of the act and opened a 12-week consultation period.
It said the code covering Chapter II had been refined since an earlier draft two years ago to take account of current practice, fill gaps where the original draft had offered insufficient guidance, reduce unnecessary bureaucracy and address parliamentary concerns over data protection.
The Part III measures on encryption keys have not yet been implemented because the development and adoption of encryption and other information protection technologies “has been slower than was anticipated when the Act was passed” the second consultation paper says.
It adds that investigators tackling crime and terrorism “have begun encountering encrypted and protected data with increasing frequency”.
This, and the rapidly growing availability of encryption products including integrated security features in operating systems, “has led the government to judge that it is now timely to implement the provisions of Part III”.
Comments on the two draft codes are invited by 30 August.