Sergey Nivens - Fotolia

Investigatory Powers Bill looks set to become law

Rights groups have vowed to continue to oppose the controversial Investigatory Powers Bill, which is now just two steps away from becoming law

The controversial Investigatory Powers Bill (IP Bill) has been passed by both houses of Parliament and is likely to become law, but opposition by human rights and privacy campaigners remains high.

Now the bill has been passed by the House of Lords, all that remains before it receives royal assent to become law is a consideration of amendments by both houses.

This means the bill, also known as the Snoopers’ Charter, is likely to become law before the end of 2016 in line with the government’s target to have legislation in place before the expiry of the Data Retention and Investigatory Powers Act (Dripa) that was rushed through Parliament in July 2014.

The Home Office, which is responsible for the IP Bill introduced by Theresa May while still home secretary, claimed the bill was necessary to protect the country’s national security, and had sufficient oversight for the surveillance powers it gave. But civil rights groups have said the powers are draconian and too intrusive.

The IP Bill grants intelligence agencies the ability to obtain and use bulk personal datasets that will include mostly individuals who are not suspected in any wrongdoing.

In August 2016, a report by David Anderson, Queen’s Counsel, said there was no alternative to the controversial bulk surveillance powers proposed in the bill, but human rights group Liberty said there was no compelling operational case for each of the IP Bill’s bulk powers.

For each bulk power, Liberty said, an exploration of the technical options available to our spies shows that a targeted approach would do the job just as well.

IT service providers and privacy campaigners alike have expressed concerns about “equipment interference” provisions allowing security services to hack into computers, networks and mobile devices.

But supporters of the bill have argued there is more oversight than ever before, pointing out that security and intelligence agencies must apply for a warrant from the secretary of state and these groups are the only people who can complete bulk hacks.

Read more about the Investigatory Powers Bill

Former government communications headquarters (GCHQ) head David Omand told a security conference in London in October 2016 that the UK would be the first country in Europe to legislate and regulate digital intelligence, and put it under judicial supervision with judicial review.

The bill introduces the new roles of an investigatory powers commissioner and judicial commissioners to approve warrants and handle issues that arise from the new powers. The commissioner will also audit compliance, undertake investigations, issue public reports, and publish guidance on the proper use of investigatory powers where necessary.

Another controversial provision of the bill is that security services and police forces will be able to access communications data, which means internet history data will have to be stored for 12 months. Communications service providers will also have to store metadata about the communications made through their services.

A huge security risk

These provisions have raised concerns about how this data will be protected. “Aside from the arguments around privacy, which are extensive and valid, it’s also a huge security risk,” said Ed Macnair, CEO of cloud security firm CensorNet.

“Can you imagine the damage that could be done to individuals if their private browsing history was made public? That’s not people on ‘dodgy’ sites, but individuals with highly personal concerns, from sexuality and HIV, to addictions and depression.

“The Ashley Madison data breach, if nothing else, showed us the devastation that occurs when incredibly personal information is leaked,” said Macnair. “I hope the government has seriously considered the security implications of this law, otherwise it could be very dangerous indeed.”

“Other countries, including authoritarian regimes with poor human rights records, could use this law to justify their own intrusive surveillance powers”
Jim Killock, Open Rights Group

In reaction to the bill being passed by the House of Lords, Open Rights Group has vowed to continue to oppose the legislation.

“The passing of the IP Bill will have an impact that goes beyond the UK’s shores. It is likely other countries, including authoritarian regimes with poor human rights records, will use this law to justify their own intrusive surveillance powers,” said Jim Killock, Open Rights Group executive director.

“The IP Bill will put into statute the powers and capabilities revealed by Edward Snowden, as well as increasing surveillance by police and other government departments,” he said. “There will continue to be a lack of privacy protections for international data sharing arrangements with the US Parliament, which has also failed to address the implications of the technical integration of GCHQ and the NSA.

“While parliamentarians have failed to limit these powers, the courts may succeed,” said Killock. “A ruling by the Court of Justice of the European Union, expected next year, may mean parts of the bill are unlawful and need to be amended. Open Rights Group and others will continue to fight this draconian law.”

Read more on Privacy and data protection