A new licence for spies and police?
3 November 2015
Despite the recent release of the latest James Bond film, what really worries Britain's spies at the moment is not the cinematic licence to kill but what they call their "licence to operate". It may sound far less dramatic, but the reason normally shy spies have been appearing in the media and opening up their normally secret facilities is because they know just how much is at stake for them as well as law enforcement in Wednesday's Investigatory Powers Bill. The aim of that bill is to completely overhaul the laws governing how the state, police and spies can access communications and other forms of data. Everyone - from spies to privacy activists - agree the existing laws are out of date and need an overhaul. The 15-year-old Regulation of Investigatory Powers Act (Ripa) has been creaking at the seams, and many of the powers the state has exercised have been opaque. A major study by David Anderson QC, the independent reviewer of terrorism legislation, argued this made the current system "undemocratic". The opportunity is there, all sides say, to create a "world-class" system that is comprehensive and comprehensible. But the question will be how exactly does that system work and what will it allow? The Anderson review pointed the way to something of a consensus - the spies would keep their powers but make their use more transparent and with new oversight and authorisation controls. That means we should expect on Wednesday a clear outline of what powers the state has. These range from the well-known, such as gathering communications data (the details about but not the content of communications) and the interception of the actual content of emails and phone calls, through to the capabilities only recently revealed (in many cases in the wake of Edward Snowden) such as the collection and analysis of bulk data and so-called computer network exploitation (the fancy word for hacking into computers). Previously, the attitude of spies seemed to be one of security through obscurity to the point of absurdity. Before US National Security Agency whistleblower Edward Snowden, many of the powers spies enjoyed were never discussed. And even when the first allegations came out, GCHQ was unable or unwilling to explain what precise laws authorised certain activities such as bulk data collection. Eventually, GCHQ explained it came under provisions of Ripa, which would lead to convoluted explanations impenetrable to almost everyone - referring to things such as the use of "16(3) authorisations to act as functional equivalents to 8(1) warrants when looking at data collected under an 8(4)". The legal basis for computer hacking was also slipped out earlier in the year under an "equipment interference code of practice", with almost no explanation. GCHQ may have been in the firing line because of Edward Snowden's allegations - but MI5 and MI6 also use bulk data and computer-hacking powers, and they too had relied on a veil of secrecy and obfuscation over their work that was no longer sustainable. So, for spies, the new law offers an opportunity to come clean with the public about what they can do and obtain consent for the continuation of powers they say (and independent voices like David Anderson concurred) are important to their role in protecting national security. The contentious issue will be how far the proposed legislation sticks narrowly to the Anderson consensus or moves beyond it. Here, there are two areas to watch. The first is the retention of details about people's web browsing (up to the first slash of a website address, which would let police see the websites people had visited but not the specific pages they had viewed) for 12 months by internet service providers so it can be requested by authorities. This is primarily driven by police. It was one of the controversial proposals of the abandoned 2012 bill that led to it being branded a "snooper's charter", and the Anderson review said that any proposal would require a detailed operational case to be made and a rigorous assessment would be needed on the lawfulness, effectiveness and intrusiveness. But while it has been hard to keep the spies off the airwaves and out of the pages of the newspapers in recent weeks, few would consider the police to have made their case for this power in public so far. The police are only now starting to make the point that internet connection data is increasingly important for their work - for instance, tracing people sharing child abuse images on the web or using internet-based communications platforms to plan or carry out traditional crimes or new forms of cybercrime. They argue that this merely updates the kind of power they have had to collect communications data from phones into the internet age. But they may be making their case too late in the day. For the public, any type of measure to reveal browsing history hits a nerve that other powers do not. Privacy advocates argue that the extent to which we live our lives online means the relative intrusion of having that browsing data collected and stored is much greater. There will be the additional question of security. What if hackers can get into their systems to steal and then sell or release browsing data? The breach of TalkTalk by hackers will do little to reassure those worried by this possibility. The second contentious issue will be whether ministers or judges sign warrants for the most intrusive form of surveillance such as interception of communications warrants. Currently, ministers sign off on interception warrants (the home secretary for most of those in the UK, the foreign secretary overseas). The Anderson review proposed that judges sign off many of those - although not all, since in areas of national security a minister would still sign but a judge would effectively check it. The issue of a greater judicial role has become something of a touchstone for privacy and civil liberty campaigners. Some ministers have worried that losing their role in signing off warrants will reduce the political accountability over law enforcement and intelligence operations and undermine what has been a close working relationship, but the consensus seems to have moved towards a stronger judicial role. The spies and police say they will work under any system and their only real concern is that it is flexible and speedy enough to deal with urgent requests. The judicial versus ministerial debate also has potentially important ramifications beyond the UK. Part of the push for judicial warrants is because supporters believe they will make it more likely that any system survives challenges at the European Court of Human Rights and because it may make it much more likely that a deal can be done with the United States to facilitate the co-operation of Silicon Valley companies in sharing data. The publication of the bill on Wednesday is only the start. It will then go to both Houses of Parliament for pre-legislative scrutiny, giving plenty of time for critics to pick over the details and potentially for the two contentious areas to be modified. And it will be the details that matter when it comes to whether a consensus emerges that really does provide a new licence to operate.
The Anderson review pointed the way to something of a consensus - the spies would keep their powers but make their use more transparent and with new oversight and authorisation controls. That means we should expect on Wednesday a clear outline of what powers the state has. These range from the well-known, such as gathering communications data (the details about but not the content of communications) and the interception of the actual content of emails and phone calls, through to the capabilities only recently revealed (in many cases in the wake of Edward Snowden) such as the collection and analysis of bulk data and so-called computer network exploitation (the fancy word for hacking into computers). Previously, the attitude of spies seemed to be one of security through obscurity to the point of absurdity. Before US National Security Agency whistleblower Edward Snowden, many of the powers spies enjoyed were never discussed. And even when the first allegations came out, GCHQ was unable or unwilling to explain what precise laws authorised certain activities such as bulk data collection. Eventually, GCHQ explained it came under provisions of Ripa, which would lead to convoluted explanations impenetrable to almost everyone - referring to things such as the use of "16(3) authorisations to act as functional equivalents to 8(1) warrants when looking at data collected under an 8(4)".
7173_0
Security or absurdity?
The second contentious issue will be whether ministers or judges sign warrants for the most intrusive form of surveillance such as interception of communications warrants. Currently, ministers sign off on interception warrants (the home secretary for most of those in the UK, the foreign secretary overseas). The Anderson review proposed that judges sign off many of those - although not all, since in areas of national security a minister would still sign but a judge would effectively check it. The issue of a greater judicial role has become something of a touchstone for privacy and civil liberty campaigners. Some ministers have worried that losing their role in signing off warrants will reduce the political accountability over law enforcement and intelligence operations and undermine what has been a close working relationship, but the consensus seems to have moved towards a stronger judicial role. The spies and police say they will work under any system and their only real concern is that it is flexible and speedy enough to deal with urgent requests. The judicial versus ministerial debate also has potentially important ramifications beyond the UK. Part of the push for judicial warrants is because supporters believe they will make it more likely that any system survives challenges at the European Court of Human Rights and because it may make it much more likely that a deal can be done with the United States to facilitate the co-operation of Silicon Valley companies in sharing data. The publication of the bill on Wednesday is only the start. It will then go to both Houses of Parliament for pre-legislative scrutiny, giving plenty of time for critics to pick over the details and potentially for the two contentious areas to be modified. And it will be the details that matter when it comes to whether a consensus emerges that really does provide a new licence to operate.
7173_1
Ministers or judges?