Yesterday, the UK government introduced a revised version of its Investigatory Powers Bill (aka the “snooper’s charter”) to Parliament. The bill seeks to consolidate, for the first time, all of the UK intelligence agencies’ surveillance powers under one law, and ministers are pushing to pass it by the end of this year, despite the complexity of the legislation and the difficulty Parliament will have meeting that compressed timeline.
A draft version of the bill was published in early November and was reviewed by three parliamentary committees, all of which criticized the government’s proposals and identified areas for further work. The Joint Committee on the Investigatory Powers Bill warned that the earlier version “lacks clarity,” is “inconsistent and confusing,” and adopts a “piecemeal approach” to privacy protections, while the Intelligence and Security Committee (ISC) said that the draft bill generally presents a “missed opportunity” to “provide the clarity and assurance which is badly needed.” (The Science and Technology Committee’s review is here.)
A source at the UK Home Office, which produced the legislation, claimed that the revised bill “reflects the majority” of the reports’ recommendations, adding that: “We have strengthened safeguards, enhanced privacy protections and bolstered oversight arrangements.”
Yet, on a bill as lengthy and detailed as this one (which rings in at more than 250 pages, not to mention the half dozen accompanying codes of practice and supporting documentation), the jury remains out on whether the revised version adequately addresses the recommendations made by the three committees. The immediate response from privacy and civil liberties organizations suggests it has failed in this task, with most arguing that the bill’s revisions are barely cosmetic. (A much Tweeted example of this is the government’s insertion of the word “privacy” to one section title in response to calls from the Intelligence and Security Committee for privacy protections to form the “backbone” of the legislation.) UK-based Privacy International said that the “published version of the Bill is plainly not fit for purpose.” The UK’s independent reviewer of terrorism legislation, David Anderson wrote today that the bill is still a “work in progress.”
So what has changed? Police powers to access everyone’s web browsing histories (so-called internet connection records or ICRs) have been expanded in the new draft, the bill forcing internet service providers to store the browsing data of all customers for 12 months. Law enforcement will be able to obtain these records even if they don’t include visits to illegal websites or interactions with communication services (as was required in the earlier draft of the legislation).
On encryption, the Home Office appears to have taken some heed of the concerns expressed by the technology industry (for an example, see Apple’s written submission to the Joint Committee). Under the latest draft, no company will be compelled to remove encryption from its own services if it is not technically feasible, and financial viability will be taken into account. Unfortunately, the language in the draft remains broad and uncertain, and commentators have expressed concern that a test based on “practicability” lends little confidence about the scope of the obligation being placed on service providers.
When it comes to oversight, commentators have called for a “powerful and technically adept” body (known as the Investigatory Powers Commission). The new draft of the bill now confers individual judicial commissioners with powers to initiate their own investigations, publish guidance, and seek independent legal advice. However, despite the recommendations of the Joint Committee (recommendation 51), the revised version fails to establish the oversight structure as a free standing body as opposed to a group of judges.
On judicial authorization, the new version remains broadly the same, maintaining the controversial “double lock” system proposed in the initial draft. This mechanism will be used to authorize the most intrusive surveillance methods, and involves ministerial authorization backed by review by a judicial commissioner. A much criticized urgent executive authorization procedure remains, subject to judicial scrutiny after three working days (rather than five).
Protections for legal professional privilege (LPP) are now on the face of the bill, though the safeguards proposed are limited. The interception of LPP material is expressly authorized by the bill, but only in “exceptional and compelling circumstances,” which are not defined.
Despite its size and detail, ministers want the bill passed unusually quickly, saying that a compressed timeline of less than a year from introduction of the revised bill to passage is necessary due to the urgent demands of national security and crime prevention. Home Secretary Theresa May has expressed concerns that if the new legislation is not in force by year’s end, important investigatory and surveillance powers will lapse. She was referring to the sunset clause in the Data Retention and Investigatory Powers Act 2014 (DRIPA), which provides that the act will be repealed on December 31, 2016. Skeptics have refuted this argument however, saying that Parliament has the power to renew DRIPA for a further year (among other options), giving lawmakers the time they need to properly debate and consider the Investigatory Powers Bill.
Warning that it is “not in the nation’s interest” to pass the bill this year, over 100 cross-party lawmakers and campaigners signed a letter calling on the government to rethink its timeline, stating:
Surveillance is a global concern, and this new law, if done right, could lead the world. It will affect security, freedom and commerce. We must give the Bill the time it needs – not rush it through Parliament. We urge the Government to think again.
The British government’s hopes of enacting the bill into law by the end of the year requires lawmakers to act on an extremely tight timeline to advance the legislation, and means passing it through both Houses of Parliament by December. With three recesses from Parliament this year and two prorogations (i.e., end of a parliamentary session) for local elections and the EU Referendum in June, it will be a big ask for lawmakers to undertake the level of detailed scrutiny required to vet and pass such a bill.
From here, the next stage in advancing the bill will be the Second Reading in the House of Commons, where Members of Parliament can debate the principles enumerated in the bill. This is expected to take place on March 14, though it has not been officially scheduled yet. It is rare for a bill to fall at its Second Reading. Following that first hurdle, the bill will likely be subjected to detailed debate and amendment at each of the subsequent stages required to advance a bill in the House of Commons (i.e., the Committee Stage, Third Reading, and Report). The same process will then be repeated in the House of Lords before the bill can go in the statute books.
Keep an eye out for further analysis on the Investigatory Powers Bill on Just Security. In the meantime, check out Shaheed Fatima’s in-depth analysis of three particularly controversial aspects of the bill’s earlier draft, along with her post on the role and extent of judicial oversight provided by that draft of the bill.