“the importance of clear law, fair procedures, rights compliance and transparency: not just fashionable buzz-words, but the necessary foundation for the trust between government and governed”

The publication today of A Question of Trust: Report of the Investigatory Powers Review by David Anderson Q.C. — the UK’s Independent Reviewer of Terrorism Legislation — will light up the debate on state surveillance in the UK and elsewhere. Anderson’s report is remarkable in its breadth and depth, running to 373 pages including its 17 Annexes, and offering five principles and 124 recommendations to guide the development of a new comprehensive law on surveillance in the UK.

The principles and recommendations aim to enable law enforcement and intelligence agencies to protect the UK while also ensuring that their powers are subject to limits in law and to compliance with human rights standards. In particular Anderson calls for a new legal framework to govern surveillance powers that will provide both capabilities and safeguards. The report will require careful assessment over the coming weeks and months. There is too much in it to do it justice in a single post and so this brief overview serves as an initial primer for the lengthy debate to come.

Background, Review & Report

The Investigatory Powers Review is a statutory obligation imposed by section 7 of the Data Retention and Investigatory Powers Act 2014. The Act is emergency legislation brought about by Parliament in the aftermath of the EU Court of Justice ruling in Digital Rights Ireland that the EU Data Retention Directive was unlawful. The UK law sought to provide a legal basis for the continuation of data retention in the UK – albeit with a sunset clause in recognition of the need for more sober reflection that the Act’s swift passage through Parliament would allow. To aid that reflection section 7 obliged the Home Secretary to appoint the Independent Reviewer of Terrorism Legislation to review ‘investigatory powers’. The review had wide terms of reference, taking in interception of communications and data retention powers available to all public authorities.

The review necessarily goes far beyond counter-terrorism – Anderson’s usual domain as Independent Reviewer. It also includes review of powers used in counter-espionage and counter-proliferation, against online crime including fraud and child sexual exploitation, as well as the use of investigatory powers to address offline crime such as murder. The published report draws on almost seventy written submissions to an open call for evidence as well as meetings with Government, business, and civil society groups. International evidence is drawn from across the EU (and in particular the English-speaking) world. It is methodical to the end – setting out the current state of the law, the threat to UK security, perceptions of privacy, and technological capabilities in a level of detail befitting an expert on any one of those diverse subjects. The report then goes on to summarise the views of law enforcement agencies, intelligence agencies, service providers and civil society before offering Anderson’s own conclusions and recommendations. A careful read of the report will easily take a day – a full analysis even longer – and so its implications will likely take some time to unravel in full. However its headline conclusions are clear from the outset.

Five Key Principles

Perhaps the key contribution of A Question of Trust is Anderson’s development of five principles to guide law and practice of investigatory powers.

The Anderson Principles are:

  • Minimization of no-go areas;
  • Limits on powers;
  • Rights compliance;
  • Clarity and transparency; and
  • A unified approach.

These principles might seem uncontroversial at first. However, their elucidation in 124 recommendations is likely to give rise to passionate debate given the strength of opinion on the subject already in evidence in the UK and in the wider world. For example, privacy campaigners may be unhappy with Anderson’s endorsement of the contention that the law should seek to minimize the (virtual) areas where individuals’ actions are beyond the reach of investigation. However, this principle goes hand-in-hand with the second, and Anderson also notes that at times the principle of limits on powers necessarily means that some crime may go unpunished. There is strong reliance throughout the Report on the principles of necessity and proportionality – imports into the UK legal system from the EU and the Council of Europe – and Anderson makes it clear that new powers should be given only if the case for them has been made out. He also advocates for clear and transparent law and practices, to the extent that operational realities will allow, and this clarity and transparency would do much to facilitate better assessments of necessity and proportionality.

New Law and a New Institution

A first step in clarity and transparency will be to bring about significant architectural changes in this field. Anderson’s proposals include new legislation and a new institution. The key legal change is the proposal to replace the following law with ‘a comprehensive new law’:

Further statutes may also require amendment if others of Anderson’s recommendations are implemented. A new legal architecture would – again not without controversy – govern the use of powers by both law enforcement and intelligence agencies. Anderson does not accept the arguments for a separation in the legal architecture. The Report’s rebuttal of those arguments is convincing even if the implications of their combination merits ongoing reflection.

The Report does recommend a change in institutions. It calls for the establishment of a new body, the Independent Surveillance and Intelligence Commission (ISIC). This body would replace three existing ones: the Interception of Communications Commissioner’s Office (IOCCO), the Office of Surveillance Commissioners (OSC) and the Intelligence Services Commissioner (ISCommr). The new body would have supervisory responsibility so as to improve the operation of investigatory powers and would also aim to build public trust through its profile and engagement. ISIC would also be involved in a change in process. The Report’s details as to changes in process are many and may bamboozle those unfamiliar with existing law. However, one significant change follows from Anderson’s note that the UK is an outlier amongst the Five Eyes states (Australia, Canada, NZ, UK, & USA) in not having prior judicial authorization of interceptions of communications. Thus, the report recommends that Judicial Commissioners at ISIC serve this function in relation to interceptions and, in certain circumstances, as regards requests to access communication data. This change, although not necessarily a requirement of European or international law, would bring British law in line with emerging international standards of best practice.

International Implications

The Report is openly aware of its international audience. Anderson calls for the new law to have structure and expression so as to enable ‘its essentials to be understood by intelligent readers across the world’. This is recognition that, owing to challenges of territoriality on the Internet, British law may be applied to those overseas. It is also an acknowledgement that any new UK law may provide a model for other states developing their capacities and legal frameworks in this field. A further international implication will require exploration in more detail. Anderson suggests that although the EU Court of Justice found the Data Retention Directive unlawful, that Court’s judgment did not find data retention per se unlawful. This appears to be correct. The judgment was one that upheld the rule of law but did not settle the question as to the relationship between privacy and security. On this question, too, Anderson has much to say even as the debate moves beyond law into broader social attitudes.

Next Steps

After the dust settles – what next? The new UK Government promises to bring forward legislation to address capabilities gaps in law enforcement and intelligence agencies’ powers. A previous attempt at such legislation foundered in 2012 owing to disagreement between the Conservative Party and the Liberal Democrats in the then-coalition government. Now, with an overall majority in the House of Commons, the Conservative Party can pursue its policies more freely. The weight of this report will, however, provide a constraint against loose policy-making. The report does not offer a carte blanche for a surveillance state – far from it. Instead Anderson has given Parliament an ambitious blueprint from which to begin to build a new surveillance architecture for the UK. The work will not be without its challenges. Even if all 124 recommendations are implemented in full it will be necessary to ensure that operational culture develops to accept the implications of the Anderson Principles. There is also a significant challenge to cultivate public trust in a field of governance where much has been done to damage it. To achieve such trust requires a robust and informed public debate. It is for its contribution to that debate, as much as anything else, that the Report is most commendable indeed.