The controversial Investigatory Powers Bill (IP Bill) has been passed by both houses of Parliament and is likely to become law, but opposition by human rights and privacy campaigners remains high.
Now the bill has been passed by the House of Lords, all that remains before it receives royal assent to become law is a consideration of amendments by both houses.
The Home Office, which is responsible for the IP Bill introduced by Theresa May while still home secretary, claimed the bill was necessary to protect the country’s national security, and had sufficient oversight for the surveillance powers it gave. But civil rights groups have said the powers are draconian and too intrusive.
The IP Bill grants intelligence agencies the ability to obtain and use bulk personal datasets that will include mostly individuals who are not suspected in any wrongdoing.
For each bulk power, Liberty said, an exploration of the technical options available to our spies shows that a targeted approach would do the job just as well.
IT service providers and privacy campaigners alike have expressed concerns about “equipment interference” provisions allowing security services to hack into computers, networks and mobile devices.
But supporters of the bill have argued there is more oversight than ever before, pointing out that security and intelligence agencies must apply for a warrant from the secretary of state and these groups are the only people who can complete bulk hacks.
The bill introduces the new roles of an investigatory powers commissioner and judicial commissioners to approve warrants and handle issues that arise from the new powers. The commissioner will also audit compliance, undertake investigations, issue public reports, and publish guidance on the proper use of investigatory powers where necessary.
Another controversial provision of the bill is that security services and police forces will be able to access communications data, which means internet history data will have to be stored for 12 months. Communications service providers will also have to store metadata about the communications made through their services.
A huge security risk
These provisions have raised concerns about how this data will be protected. “Aside from the arguments around privacy, which are extensive and valid, it’s also a huge security risk,” said Ed Macnair, CEO of cloud security firm CensorNet.
“Can you imagine the damage that could be done to individuals if their private browsing history was made public? That’s not people on ‘dodgy’ sites, but individuals with highly personal concerns, from sexuality and HIV, to addictions and depression.
“The Ashley Madison data breach, if nothing else, showed us the devastation that occurs when incredibly personal information is leaked,” said Macnair. “I hope the government has seriously considered the security implications of this law, otherwise it could be very dangerous indeed.”
“Other countries, including authoritarian regimes with poor human rights records, could use this law to justify their own intrusive surveillance powers”
Jim Killock, Open Rights Group
In reaction to the bill being passed by the House of Lords, Open Rights Group has vowed to continue to oppose the legislation.
“The passing of the IP Bill will have an impact that goes beyond the UK’s shores. It is likely other countries, including authoritarian regimes with poor human rights records, will use this law to justify their own intrusive surveillance powers,” said Jim Killock, Open Rights Group executive director.
“The IP Bill will put into statute the powers and capabilities revealed by Edward Snowden, as well as increasing surveillance by police and other government departments,” he said. “There will continue to be a lack of privacy protections for international data sharing arrangements with the US Parliament, which has also failed to address the implications of the technical integration of GCHQ and the NSA.
“While parliamentarians have failed to limit these powers, the courts may succeed,” said Killock. “A ruling by the Court of Justice of the European Union, expected next year, may mean parts of the bill are unlawful and need to be amended. Open Rights Group and others will continue to fight this draconian law.”
