The Investigatory Powers Act 2016 (Act) has passed into law, having been through three independent reviews and extensive amendments in the House of Commons. The Act will give the UK government unprecedented surveillance powers and is regarded by Edward Snowden as "the most extreme surveillance in the history of western democracy".
The Act allows the UK government to keep a record of every website accessed, phone app used, and the metadata of all telephone calls made by every citizen for up to a year. This type of information is known as internet connection records (ICRs). The ICRs will include when a citizen visited a certain webpage, how long they stayed, their IP address, and information about their electronic device. The Act also forces internet providers and mobile carriers in the UK to store ICRs and gives police officers the power to access and retrieve such information through a process known as the 'request filter'. It is still unclear how the process works and how much information the police may retrieve. The lack of judicial oversight for such a power is worrying. Access to such ICRs will be solely at the discretion of the police.
The Act also extends the UK government's power to collect metadata around the world. Referring to hacking as "equipment interference", the Act permits the Government to engage in targeted hacking of individuals' computers, including by means of phone bugging and reading texts. Unlike the ICRs, 'equipment interference' would require a warrant from both the Secretary of State and a panel of judges. This power extends to 'bulk equipment interference' meaning that it is capable of hacking large groups of people outside of the UK.
The Act is part of an international trend that endows governments with wide-ranging powers of surveillance and intrusion subject to limited oversight, which pose a significant threat to the privacy of individuals and corporations.