Update on the UK's Investigatory Powers Act

Since we last reported on the draft Investigatory
Powers Bill (please see our March
2016 and November
2015 updates), the Bill has continued its progression through Parliament and
is currently in the Committee Stage at the House of Lords. 

The Bill is still attracting public controversy and a number
of amendments have been suggested during its Parliamentary passage, with the
more substantive changes being put forward during the House of Lords Committee
Stage. 

Meanwhile on 19 August 2016, David Anderson QC, the independent
reviewer of terrorism legislation, published his Bulk
Powers Review – a review into the operational case for the four bulk collection powers set out in the Investigatory Powers Bill.

The next stages (the remaining Committee Stage at the House
of Lords, Report Stage, Third Reading and Consideration of Amendments) are expected
to be completed in the autumn, commencing with the House of Lords Committee
Stage which reconvenes on 5 September.

In this update, we summarise:

• the key discussion and amendments during the Bill’s progress through Parliament to date; and
• the key conclusions of the Bulk Powers Review.

Internet Connection Records (ICRs) 

The ICR provisions have grabbed much of the public attention and have been a key focus of discussion and amendment during the Committee Stage. 

In brief, ICRs are the records of the communication service used rather than the content of the communications themselves (i.e. they show the website accessed rather than the individual web pages viewed). 

The House of Lords Committee Stage has introduced a new threshold to be met before ICRs can be obtained by public authorities. Under the new proposal, if the ICRs are obtained for the purpose of preventing or detecting a crime and the service and time of use are not known, then the crime in question must be a “serious crime” or “other relevant crime”. 

In practice, this new threshold (if retained) requires that either:

• the crime is one which carries the penalty of a term of 6 months (or more) imprisonment; or
• an integral part of the crime involves the sending of communications or a breach of a person’s privacy. Discussions in the Committee Stage suggested that this would include cyber-stalking and online fraud but, in practice, it may be difficult to assess whether this threshold is met without clearer guidance on the meaning of “integral” in this context. 

However, the obligation on communications providers to retain ICRs when requested appears to remain, despite concerns over the cost and practicality of storing them securely.

Encryption

The position on encryption remains somewhat confused. 

House of Lords Committee members criticised the current position in the Bill which requires communications operators to decrypt messages for the authorities. The members highlighted that, if a back-door is created in an encrypted system, then (by definition) the system will no longer be secure. An obligation to decrypt may undermine public confidence in such technology and put UK technology at a disadvantage. As such, members of the Committee argued that it “threatened the entire operation of large parts of the digital economy“. 

The government response, given by Lord Howe, was that telecommunications operators would not be obliged to decrypt where it is not reasonable or practicable to do so. He also stressed that the government is not banning end-to end encryption. 

This response does not fully engage with industry’s concerns that a built-in ability to decrypt will undermine the security, and therefore the concept, of encryption.

Costs

The government has not changed its existing position that telecommunications operators will be reimbursed in relation to “100% of reasonable costs incurred by the communications service providers, and that includes both capital and operational costs.” 

However, the government has refused to codify this commitment in the Bill itself, which may be of little comfort to communications operators.

Privacy

Although members of the House of Lords Committee requested amendments to resolve the tensions between privacy and legal interception obligations, these do not appear to have been accepted by the government, at least at present.

Legal professional privilege

The House of Lords Committee debated the right for the authorities to intercept privileged information (including communications between a lawyer and client). The consensus was that this must be properly safeguarded. The government is still considering this controversial provision and stress that it will only be used in exceptional circumstances. It remains to be seen how these concerns will be translated into amendments to the Bill.

Bulk Powers Review

David Anderson QC’s review of the four bulk collection powers provided for in the Investigatory Powers Bill only looked at the operational case for these powers, not whether these powers are desirable, or should be passed into law, or whether any safeguards should be applied to them. 

The review concluded that:

• there is a proven operational case for three of the powers (bulk interception, bulk acquisition of communications data, and bulk personal datasets);

• there is a distinct (though not yet proven) operational case for the fourth power, bulk equipment interference; and

• given the pace of technological change, the Investigatory Powers Bill should be amended to provide for a Technical Advisory Panel of security-cleared independent academics and industry experts to be appointed “to advise the IPC and the Secretary of State on the impact of changing technology on the exercise of investigatory powers and on the availability of techniques to use those powers while minimising interference with privacy“. 

This development will undoubtedly be discussed further during the remaining stages of the Bill’s passage through Parliament.

Osborne Clarke comment

The Bill has attracted an emotive response since its publication, and this is reflected in the amendments to it as it progresses through the parliamentary stages. At present, the majority of the agreed amendments clarify the government’s position in relation to interception rather than introducing new substantive concepts or measures. In addition, there have been no suggested changes to the Codes of Conduct at this stage.
However, the Bill still has some key stages to complete its Parliamentary passage, and further amendments and adjustments will continue to be made. At present, it is still hard to predict how extensive or far-reaching these will ultimately be.