Lessons from history for UK Home Sec Theresa May's Investigatory Powers Bill
Been there, read the law, got bulk-intercepted
IPB “Let me be clear,” Theresa May said on the introduction of the Investigatory Powers Bill in Blighty, “the draft Bill we are publishing today is not a return to the draft Communications Data Bill of 2012.”
She was referring to the previous, the UK's previous coalition government's attempt at a Snoopers' Charter.
This was true in one respect – unlike the aborted Communications Data Bill, the Investigatory Powers Bill is very likely to become law, and to do so this year.
Contrary to the Home Secretary's claims, however, there is a clear continuity between this legislative attempt and those which have come before it.
It is the latest of successive attempts to rush into law an increase of the state's legal facilities for storing and accessing citizens' communications data.
Interception of Communications Act 1985
It was in 1984 that a case heard by the European Court of Human Rights (EctHR) indirectly produced the UK's first surveillance law. Ruling on Malone v The United Kingdom, the Strasbourg court found that the Home Office's ongoing phone tapping activities were in breach of the European Convention on Human Rights (ECHR). The guidelines of the time were “somewhat obscure and open to differing interpretation” said the court, and as such the phone-tapping activities were determined to be not “prescribed by law".
Following this, the government passed the Interception of Communications Act 1985 to meet its obligations under the ECHR – which said that any interference by a public authority under Article 8's right to privacy could only be that which is explicitly allowed by law.
This was the first time a British government had created legislation that dealt specifically with the interception of communications. At the time of its passing, the Bill was criticised for the balance of powers it allocated to the state, and for the lack of clarity in its drafting.
Ironically, it would actually be a matter of the 1985 Act's specificity that would provoke its repeal and the creation of a replacement.
According to the University of Oxford's Law Faculty, on Intercept Communication (PDF), the 1997 case of Halford v The United Kingdom embarrassed the government yet again when the court judged that the 1985 Act did not prescribe the interception of communications made through private telecommunications systems – such as the claimant had used – but only “a public telecommunications system” as the legislation referred to.
A new Labour Government held a consultation (PDF) in which then Home Secretary Jack Straw recognised advances in technology had pulled the carpet from beneath the 1985 Act.
Straw's consultation made public the Government's opinion: “That the law surrounding access to communications data is in need of revision,” and added that it was thus “proposing to establish a clear, statutory framework for access to communications data.”
Alas, the replacement would prove to be anything but.
The Regulation of Investigatory Powers Act 2000
The Regulation of Investigatory Powers Act 2000 (RIPA) was introduced to Parliament as a Bill in on 9 February 2000. The government declared that it was, as promised, “a clear, statutory framework” regulating the State's access to communications.
The Bill, it said, would bring the UK's surveillance activities in-line with the EU's view of the ECHR before the UK's Human Rights Act 1998 came into force that October – the dubious de jour cause for rushing through the legislation.
Despite these promises, the Bill was critically received by parties involved in the promotion of Human Rights. Rather than offering a welcome protection for the public, its provisions provoked criticism and concern over mandatory data decryption upon request (and prison sentences for those who had forgotten their decryption keys), the fact ISPs were obliged to intercept communications traffic (and cover the costs), and the fact it devolved to broad number of local authorities the legal power to snoop on the public.
Amid this public outcry, and the Labour Party's large majority in the House of Commons, the Bill was assessed to be facing a significant challenge in the House of Lords, where the Conservative Party's Lord Strathclyde would describe it as "a Snoopers' Charter of a Bill," adding it was, "a Bill in which, once again, only the diligence and wisdom of noble Lords is contriving to save the Government from themselves."
Competently apprehensive of this “diligence and wisdom” change came before the Bill reached the Lords. One particular amendment, was the removal of the ability of the police to conduct surveillance on Britons' web browsing without a warrant. This was, arguably, the first appearance of what are being described as Internet Connection Records (ICRs) in the Investigatory Powers Bill.
However, many powers remained, including the Bill's core data slurping provision in section 22, which established the legal justification for the State to issue notices requesting communications data. The RIP Bill completed its Parliamentary passage on 26 July 2000, and received Royal Assent just two days later. RIPA underwrites the legality of the UK's surveillance activities to this day, despite its Parliamentary process lasting less than 170 days – including weekends and recesses.
In his 2015 report, titled A Question of Trust (PDF), the Independent Reviewer of Terrorism Legislation, David Anderson QC, stated that: “RIPA, obscure since its inception, has been patched up so many times as to make it incomprehensible to all but a tiny band of initiates.”
Part One of RIPA would now be repealed entirely under the Investigatory Powers Bill, replacing its rules on the “interception of communications and acquisition and disclosure of communications data” with a new regime for authorising and safeguarding those activities.
Ross Anderson, professor of security engineering at the University of Cambridge and current director of FIPR, said: “The current IP Bill is making clear for the first time a lot of the obscure language that was put into the RIP Bill a decade and a half ago. The government of the day was legalising things it didn't want to admit doing.”
Thanks to former NSA sysadmin-turned-whistleblower Edward Snowden we’ve learned that under RIPA GCHQ was archiving millions of Yahoo! webcam conversations, including intimate chats, just in case they turned out to be useful. “Any law that can be used to argue that such behaviour is legal is a bad law,” Anderson said.
Not all that RIPA allowed was at the super-state level. Poole Borough Council was found to have been abusing the Act since 2008 by snooping on a family to see whether they lived in within a school's catchment area. The Council was subsequently found guilty of “improper use of surveillance powers” in 2010.
There have also been complaints that police forces have abused the Act to uncover journalists' sources, claims that saw the coalition government introduce the requirement that police seek judicial authorisation before accessing journalistic communications. Senior police officers, however, can still sign off their subordinates when utilising RIPA powers to pursue members of the public (including journalists) on other matters.
The Act remains the primary legislation regarding investigatory powers today, but it’s been supported by increasingly lengthy data retention rules that let authorities build ever richer datasets that they can trawl.