The Investigatory Powers Bill (the “Bill”) was introduced to the House of Commons at the start of March and passed its second reading on 15 March 2016. It will now be considered by a Public Bill Committee.
The Bill overhauls much of the existing framework that governs the interception and surveillance of communications. It provides for the interception of communications, the retention and acquisition of communications data, equipment interference and the retention and examination of bulk personal datasets. Powers of interception, acquisition of communications data and equipment interference powers are provided for, both on a targeted basis and in bulk. Although the Bill replaces many existing surveillance powers contained in legislation, such as the Regulation of Investigatory Powers Act (“RIPA”), a number of broader search powers available to law enforcement agencies under legislation such as the Police and Criminal Evidence Act appear to remain unaffected.
This version of the Bill follows a draft Bill which was the subject of considerable criticism when it was released in November 2015. The draft Bill, dubbed the “Snoopers’ Charter”, was examined by the House of Commons Science and Technology Committee, the Intelligence and Security Committee of Parliament and a Joint Committee of both Houses of Parliament. Each of these committees made a number of recommendations, some of which have been incorporated into the Bill.
Among other things, the Intelligence and Security Committee suggested that the privacy protections in the draft Bill needed strengthening and recommended that the provisions allowing for bulk equipment interference be removed. Despite this recommendation, the current version of the Bill still provides for bulk interception warrants and bulk equipment interference warrants. Existing provisions in RIPA and the Telecommunications Act governing bulk interception warrants and bulk acquisition of communications data will be replaced by the Bill. The bulk interception and acquisition provisions in the Bill have been particularly controversial, with the United Nations Special Rapporteur on Privacy noting in a recent report to the United Nations Human Rights Council that the powers “run counter” to recent judgments of the European Court of Justice and the European Court of Human Rights and “undermine the spirit of the very right to privacy.” The Government has emphasised the necessity of such powers in order to ensure public safety in the face of ongoing terrorist threats and to keep pace with developments in technology.
The Bill reforms the oversight regime for the use of surveillance powers. Interception warrants will require judicial authorisation before they can be issued by the Secretary of State. A new Investigatory Powers Commissioner will be established to replace the existing Intelligence Services Commissioner, Surveillance Commissioner and Interception of Communications Commissioner.
The Bill contains provisions that will require communications service providers to retain internet connection records for up to 12 months. It also empowers the Secretary of State to issue “technical capability notices” on communications services providers to facilitate their assistance in relation to the execution of warrants and authorisations under the Bill. Among other things, these obligations may include the removal of electronic protection such as encryption in certain circumstances. The Bill provides that a communications service provider can only be required to remove encryption that it has applied for itself, or that has been applied by a third party on its behalf.
The House of Commons Briefing Paper on the Bill acknowledges that the exercise of surveillance powers often depends on the cooperation and expertise of the technology industry. This reliance is particularly evident in the US at present, with Apple challenging an FBI search warrant requiring it to develop a software tool that would eliminate certain security protections built into phone software and Microsoft challenging the Government’s use of a domestic search warrant in the US to compel Microsoft to produce data stored on an Irish server. The House of Commons Science and Technology Committee noted that the technology industry would require certainty in terms of their obligations under the legislation and reassurance that the costs of complying would be met fully.
The Bill is to be enacted by 31 December 2016 in order to take effect before the Data Retention and Investigatory Powers Act expires. It remains to be seen whether and how the many controversial aspects of this Bill will be resolved during the legislative process and whether the new legislation will in fact provide greater clarity around the use of interception and surveillance powers.