May 18, 2016 | Javier Ruiz

Government announces new data sharing legislation in Queen's Speech

The government has just announced new data sharing legislation in the Queen’s Speech.

This is not a surprise, as the Cabinet Office has been preparing for over two years, with extensive discussions across government and with civil society groups under the Open Policy Making programme. The process culminated in a public consultation last month. We responded with quite a few critical comments, and over 160 ORG supporters wrote to the Cabinet Office to ask them to put privacy at the centre of any new measures.

As we have said before in this blog, ORG’s principles are that data sharing agreements should not lead to a widespread intrusion on people’s privacy; should be proportionate, limited in scope and enshrine fundamental rights; and carry strong safeguards against wilful abuse and unintended consequences.

However, some proposals we are expecting simply need to be withdrawn, particularly the bulk sharing of civil registration data across government. We are mainly concerned about births and marriages data. Notifications of deaths have lower privacy implications, but nevertheless should be handled sensitively. 

Electronic access to individual certificates can be positive, avoiding the need for paper copies, but this is very different from bulk sharing. Spreading civil registration data across government will lead to common identifiers and data centralisation. The government is keen to stress that they do not wish to create a new “citizen database”, but this is not the point. The same level of intrusion can be generated by widespread data matching with a form of “ID card lite”. The core principle of ID is not the card itself but the uniqueness of the number or key and the centralisation aspects.

It is very likely that these proposals will be rejected by public opinion, as previous attempts have been in the past. The Conservative Party in opposition was against ID cards and the database state, and would need to explain in Parliament why they have reversed their position in Government. These proposals are not explicitly mentioned in the data sharing notes accompanying the Queen's Speech, as are several other initiatives under discussion, so it is possible the government has seen some sense and withdrawn them. More clarity would be welcome.

The wider proposals have been severely criticised by UK tech heavyweights such as Jerry Fishenden, who argues that the proposals are not well defined - lacking “detail about basic, fundamental areas (such as security, privacy, accountability)” - and remind him of previous initiatives such as the “Transformational Government (2005), the Identity Card Act (2006), and the Coroners and Justice Bill (2008)”. Even more worryingly for government, he thinks that the proposals may not deliver their stated benefits. The proposals to increasing data sharing on fraud could be “more likely to increase fraud rather than help mitigate it”.

The policy making process around these proposals started on a very positive note, with government bringing civil society in very early to discuss our concerns. The dialogue has continued to the last minute, but we are disappointed that the master lines appear to have been set in advance at the political level, with ministers believing that data sharing is the solution and must be increased. Only room for minor changes remains in our discussions with well meaning civil servants.

We foresee some trouble for the new proposals if they end up becoming yet another attempt to increase the volume of personal data flowing across government, with legal and social constraints being seen as something to be “managed” instead of positive features. The Cabinet Office should instead be looking at smarter uses of personal data that are doubly innovative in being both efficient and citizen friendly.

The Cabinet Office is also embarked in a parallel process to create an Ethical Framework for the use of Data Science in government, which will cover issues of privacy, data sharing, and algorithmic decision-making. This framework is guided by principles such as data minimisation and the need to build robust models and take public perceptions into account.

We will wait for the government to respond to the consultation before we fully set our views. In our submission we argued that key safeguards needed to be in the face of the bill, not in codes of practice of unclear enforceability. Those powers that are being piloted, such as fraud, need sunset clauses and parliamentary discussion, not revisions by the same ministers involved.

The half baked powers on data sharing to tackle debt need to be reconsidered as part of a proper national strategy on debt management involving relevant civil society groups and debt charities. There are dangers of stigmatisation as well as intrusion into privacy.

Overall, these proposals may contain elements that are acceptable, but the newer, less considered ideas simply need to go.


[Read more] (1 comments)

May 06, 2016 | Slavka Bielikova

IPBill Public Bill Committee - what happened?

The IP Bill Public Committee has been busy this week going through all amendments to conclude the committee stage. They managed to wrap up one day earlier than scheduled and the Bill can now enter the Report Stage.

Thirteenth and Fourteenth Sittings (28 April)

Transcripts of both sittings: 13th, 14th 

The amendments tabled for these sessions discussed: 

IP Commissioner and other Judicial Commissioners

Keir Starmer - speaking for Labour - brought to the table that the appointment of Judicial Commissioners should not follow the full Judicial Appointments Commission process. Starmer pointed out that High Court judges have already been through the JAC and that there is no need for their competencies to be retested. 

These amendments also tackled the question of which judges/judicial commissioners should oversee the function of the Secretary of State. Keir Starmer, supported in this instance by the Minister for Security John Hayes, emphasized that it would be troubling if the Prime Minister makes the appointment by only consulting the Lord Chief of Justice. The amendment was withdrawn to be discussed at a later stage. 

John Hayes raised a question of hierarchy regarding the involvement of the Prime Minister (PM) and Lord Chancellor in the appointments process. Originally, the amendments would remove the PM’s involvement in the appointment process and would be substituted by the Lord Chancellor, which Hayes argued would alter the Cabinet's hierarchy. Keir Starmer agreed with the raised point and suggested it should be the Lord Chief Justice who appoints judicial commissioners. 

SNP advocated for PM’s involvement in the process. 

Main oversight functions

The amendments deal with consistency of oversight functions. Joanna Cherry - speaking for the SNP - highlighted that the obligation to remove electronic protections or encryption can be issued as either a national security notice or as a technical capability notice by the Secretary of State. The amendments she put forward would make sure the judicial commissioners have responsibility for oversight of national security notices and technical capability notices. This amendment would remove the Secretary of State to modify the functions of the IP Commissioner and Judicial Commissioners. 

This amendment was not agreed on. 

Additional functions

Joanna Cherry introduced amendments regarding additional functions that would give the Judicial Commissioners power to refer issues of concern to the Investigatory Powers Tribunal without having to rely on a complaint being made. John Hayes pointed out that this would not be necessary since judges will be able to advice on when to make a complaint. 

The amendments were withdrawn. 

Fifteenth and Sixteenth Sittings (3 May)

Transcripts of both sittings: 15th, 16th The amendments tabled for these sessions discussed: 

National Security Notices

Keir Starmer presented amendments that would subject the national security notices to the double lock mechanism, meaning that they would also need to go before the Judicial Commissioner. 

Joanna Cherry criticised the lack of national security definition. The Solicitor General responded to her criticism saying that

“Any attempt to define it in the Bill runs a real risk of restricting the ability of this country to respond to constantly evolving and unpredictable threats. It is vital that legislation does not, however unintentionally, constrain the ability of our security and intelligence agencies to protect this country.” 

These amendments were not agreed on.

Maintenance of Technical Capability

Keir Starmer raised concerns that operators might be called upon to comply with a notice from the Secretary of State. Compliance would relate to removing encryption; however, Keir Starmer described this power as too wide ranging, especially after taking into consideration that provisions for notices are merely set out in the Code of Practice and not in the Bill itself. Starmer argued the amendments tabled would provide legal certainty for industry that the government will not require backdoors to be installed into products and services. Further, the amendments would require the Secretary of State to provide evidence that the notice is justified. 

The Solicitor General made a point saying that encryption is better outlined in the secondary legislation than primary legislation on the grounds it can still be changed if it evolves. 

Joanna Cherry brought forward several points that resonate with the latest international developments regarding the Apple-FBI case. The Bill would require that the recipient of a notice must comply with it but must not disclose either its existence or its contents. The Solicitor General clarified that the Apple-FBI case in the UK setting would not be subjected to this provision because Apple does not qualify as a communication service provider which the clause relates to. However, the clause defines communication service providers as “relevant operators” and it is likely that Apple would qualify as a “relevant operator”. 

The amendments were withdrawn. 

Warrants: notification by Judicial Commissioner

Joanna Cherry brought forward amendments relating to equipment interference (hacking). The amendments require that the targets of equipment interference are notified after the act. At the moment, the targets are only notified if hacking was carried out by error of a public authority. The notice does not cover hacking by the communication service providers. 

The amendment was not agreed on. 

This was the last Public Committee sitting. The IP Bill will now go through Report Stage followed by Third Reading of the Bill in the House of Commons. The dates have not been announced yet but most likely will take place in June. 

The updated version of the Bill showing changes made in the Committee is available here.

[Read more]

April 21, 2016 | Javier Ruiz

Better Data in Government Consultation

The Cabinet Office is consulting on new legislation to extend data sharing across government. Here we set out our overall approach and main areas of concern with the proposals.

The Cabinet Office is embarked on an attempt to redesign public administration, a new digital revolution led by a belief in the power of data to solve every problem. We’ve often heard arguments that if Google can do this or that, why can’t the government. This needs some pause. At ORG we also believe that we are at the gates of a data revolution, but unless we put people squarely at the helm this may not lead to the positive outcomes data evangelists expect.

There is currently a public consultation on proposals to extend data sharing across government as part of this new drive. It concentrates on three relatively limited areas - essentially, research, fraud investigations and a more concerning area of identifying people in need of specific help or services. This is a highly sensitive area for privacy campaigners and ORG has spent a lot of time on this. We feel we need to explain in detail the process and our position in order to avoid misunderstandings. 

Government proposals on data sharing

The government wants to legislate to create several frameworks that would make data sharing agreements between public bodies - and a few private entities - easier and faster. Some of those agreements can take over two years to establish and involve considerable time and effort from lawyers. It must be stressed that data sharing already takes place and government could simply choose to follow current procedures to create all the data transfers involved in this legislation.

Our instinctive response as privacy advocates is that removing friction and barriers could also remove controls and enable the proliferation of invasive databases. For example, removing the need for Parliament to approve new data flows - a key plank of the proposals - speeds up the process considerably. It also removes public accountability. The government's approach has been to narrow the scope while introducing safeguards that they claim should provide equivalent protections against abuse, without creating unnecessary bureaucratic burdens.

The current proposals relate to quite specific areas: fraud, debt, improving research and statistics and profiling for the delivery of beneficial public services. These carry various degrees of risk, which we discuss in more detail below.

The critical question in this process is whether it is possible to have agile and fast data flows within government to quickly match policy developments while providing adequate protections and avoiding a free for all.

Open policy making experiment

These proposals have been discussed for two years as part of a groundbreaking Open Policy Making process, where civil society and civil servants have collaborated to try to achieve the highest level of consensus possible. We must stress that the process did not aim to achieve full and absolute consensus and we have disagreements and criticisms. We know that despite our best efforts the end result will not be exactly what we would have liked.

We remain positive about the engagement though, as it has sharpened our capacity to constructively intervene in policy making, and many details in the proposals have been improved. We expect that wider scrutiny under the consultation will find loopholes we may have missed.

As many of our specific objections and concerns have already been dealt with, this makes it all the more important to explain very clearly our remaining reservations about the overall approach and specific areas.

One difficult issue for us throughout the process has been to focus our engagement on privacy and data aspects, not straying too far from our core issues. At the same time, as part of civil society representing a public interest position, we've had to raise broader points on the fairness of the underlying policies. Where possible we've brought along other organisations with expertise in particular areas such as debt.

Our principles and overall concerns

ORG’s minimal criteria are that data sharing agreements should not lead to a widespread intrusion on people’s privacy; should be proportionate, limited in scope and enshrine fundamental rights; and carry strong safeguards against wilful abuse and unintended consequences.

It would be fair to say that these aspects have been taken very seriously by the Cabinet Office team and particularly the scope of proposals has been tightened. We are concerned however that in cases safeguards are placed in codes of practice, which are no substitute for primary legislation.

One concern around safeguards is the tendency throughout the process to see compliance with data protection laws as a safeguard. We have stressed that this is not necessarily the case. This is particularly problematic with the new EU General Data Protection Regulation (GDPR), which is set to replace the Data Protection Act as the backbone of privacy protections in the UK. The recently approved GDPR is a much needed update and an overall improvement, but during a long and convoluted negotiation process European governments carved out many exceptions in the GDPR that give public administrations plenty of room to manoeuvre around privacy restrictions. Data sharing legislation needs to provide specific safeguards closing any potential loopholes.

More proactively, ORG engaged in this process as an opportunity to consider the expectations and relationships between citizens and government. Putting citizens at the centre of a new data-driven administration should include devolving much higher levels of control to individuals. It is disappointing that these aspects have not been explored.

Where devolving control is not possible - e.g. taxation or justice - new information governance models need to accompany any increase in data sharing. We have concerns that simply creating a legal powers without a shift on how we see personal information could end up taking us to widespread data sharing without any consent. ORG members know better than most that data and technology can save lives, but we also know that mistaken, even if well meaning, decisions based on bad data can ruin lives. The Cabinet Office seems to have focussed on the former.

At the very least this legislative drive could be an opportunity to streamline the vast number of data gateways currently in existence and improve transparency. Where the Cabinet Office sees an administration hamstrung by restrictive privacy regulations, we refer them back to the Joseph Rowntree sponsored report from 2009, which found large numbers of government databases had problems and some may well be in breach of human rights laws.

The proposals contain some improvements on transparency, and a rationalisation of data flows has been a subtext to much of the discussions, but we believe these are not enough. We would like to see mandatory central registers of data transfers and the closure of “zombie” sharing agreements when new ones are started. Use it or lose it sunset clauses should become the norm in any new data agreement.

Accountability is also paramount. If Parliament is not to have a role in authorising data sharing we need to have mechanisms for challenging any new agreements without the need to go to court for a judicial review.

Increasing data sharing may bring some improvements to government efficiency and the quality of public policy, but the case for these positive outcomes, given the other costs, must be clearly made. The government must demonstrate that new legislation removing obstacles to data sharing will deliver improvements. Our perception during discussions was that in some cases civil servants were under pressure to come up with positive case studies after a decision that data sharing must be good had already been reached somewhere higher up. Throughout the discussions we also found a healthy scepticism among some civil servants, who believed that there were other issues that would need to be tackled, such as technical capacity and organisational culture.

The proposed strands

We will go in more detail in our response to the consultation but here we want to give a quick summary of our views on the concrete proposals included in the legislation.

The proposals around research and statistics are the least problematic from our perspective. If the safeguards proposed are applied properly sharing data for these purposes could lead to better policies and insights without causing excessive privacy intrusions.

The proposals on fraud are sensitive because there is a thin line separating it from errors. Indeed, during the discussions with the Cabinet Office we looked at the use of data to reduce administrative errors and prevent fraud as part of the same processes.

Fraud investigations can be a legitimate use of data, if done narrowly and proportionately and does not involve wholesale data matching. A key issue is who makes this judgement, can how it be challenged. There should be sufficient transparency to ensure that Judicial Review is possible. Is the ICO providing oversight?

This and other strands must also demonstrate that the sharing is working: is the privacy intrusion reducing fraud? Is the sharing targeted, or can broad searches be further narrowed? During the discussions this area was going to be tested in pilot projects and we think that is the best approach.

The third strand on profiling for public services is where we see very high risks. There are dangers of discrimination, stigma, and risk aversion leading to oversensitive reactions.

We spent a long time trying to ensure that the proposals were narrowed to only cover positive interventions, eg to identify people who are low income who could benefit from government subsidies. Interventions need to be defined very tightly. Absolutely they must not include punitive elements. There is always the danger that targeted benefits are used to withdraw generalised benefits, or reduce the pool of beneficiaries.

Even with best intentions people can be stigmatised or may simply not wish to participate. Individuals need to be able to opt out from participation and profiling as much as possible.

One common thread is the central role of HMRC's data, with many of the provisions in the proposals designed to remove statutory limitations on access. The wider implications of these changes should be debated more widely.

Specific concerns about last minute additions

In particular, two proposals have been brought into the process very late. These are very controversial, and go against the grain of the process, which was designed to find the areas where agreement could be found.

We are particularly worried about proposals to share data on debt that were removed and then brought back at the end of the Open Policy Making process. The proposals to enable widespread data sharing to tackle government debt have not been supported by a clear case, and could have huge implications for vulnerable people facing economic hardship. Creating a “single view of debtors” requires a broader strategy on public debt management that is currently missing. As such we think it would be best to leave these proposals out of the current process and take more time to consider the issue of debt as a whole, not just the data angle.

Another last minute addition is the plan for the sharing across government of data from the General Registry Office, who hold certificates for births, deaths and marriages. We have concerns about proposals for bulk sharing of the whole registry database across government to improve identification. Despite repeated reassurance from government to the contrary, the sharing of these common identifiers across government has a whiff of ID Cards lite.

The best person to make data sharing decisions for the citizen is the citizen. We can see the case for making it easier to for citizens to send certificates electronically instead of having to apply and send a paper copy by post. It is the sharing of data in bulk outside of a consent framework that is a concern. In cases where bulk registry data might be useful, such as fraud prevention, specific agreements should be explicitly mandated by Parliament, instead of creating a broad power.

In any case, bringing such proposals into this process late runs against the spirit and intention of the open policy process. Government should remove them, if only to retain the credibility of future processes. If they are retained, then civil society will take note, and be far less willing to engage in such processes in the future. There is, in short, an element of good faith which is being sacrificed here.

We have prepared a tool to help you respond to the consultation. Responses should be send by Friday 22/04/2016.

[Read more]

March 17, 2016 | Jim Killock

The Investigatory Powers debate is missing one huge power: the “filter”, or police profiling engine

The debate on the Investigatory Powers Bill has focused a lot on the new extension to police powers, and the collection of “Internet Connection Records” to keep a log of everyone’s web browsing. Critics like myself worry about the ability this creates to see into everyone’s most intimate thoughts and feelings; while proponents are prone to say that the police will never have time to look at irrelevant material about innocent people.

However, the really novel and threatening part of this proposal isn’t being given anywhere near the level of attention needed.

The truly groundbreaking proposal is the “filter”, which could be seen as a government Google search to trawl your call records, Internet and location data. The filter is clearly named so that it sounds helpful, perhaps boring or else maybe something that filters down information so that it is privacy friendly. It is anything but. It is so intrusive and worrying, I would rather you think of the Filter as the PHILTRE: the Police Held Internet–Lets Them Read Everything.

Remember when these proposals started, back in the late 2000s, under the last Labour government? Maybe not, but that’s how long Home Office officials have been trying to make this happen. Their original plan was to build a single database that would store everything they could find about who you email, message and what you read — and where you are, as logged by your mobile phone. Place all that information in a single searchable database and the dangers become obvious. So obvious that the Conservative opposition was up in arms.

How on earth would you stop abuse, if all this information was placed into a single database? Surely, it would lead to fishing trips, or police searches to find lists of all the environmental protesters, trades unionists or libertarians, and to identify who it is that seem to be their leaders? How would you stop the police from producing pre-arrest lists of miscreants before demonstrations, or from deciding to infiltrate certain public meetings? Indeed, who would be able to resist using the database from working out who was at the location of relatively petty offenses, perhaps of littering or vandalism, or calculating who had been speeding by examining everyone’s mobile phone location data.

So the current government does not want try to hoard everyone’s data into a single database. Instead, they’ve come up with the PHILTRE, which can query lots of smaller, separate databases held by each private company. As this PHILTRE can be applied to separate data stores, all at once, we are in effect back with a proposal for a single government database and all the same problems — but in a way that government can claim that it “is not a single government database”.

But as long as the data can be queried and sorted in parallel, it becomes immensely powerful and just as intrusive. For instance, for a journalist to protect against revealing a whistleblower, they would need to avoid not just phoning them, but meeting them while both were carrying their mobiles and creating matching location logs. All of the profiling and fishing expeditions are just as easily achievable.

Most worrying is the authorisation process. Police, agencies and tax authorities will continue to authorise their own access of our personal data, just as they do today with phone call records — there’s not a judge anywhere near the day to day use of this search facility.

The Home Office is selling this Google-style search through the population’s mind as a privacy enhancement. Only the relevant search results will be returned. Masses of irrelevant information about other people will not have to be given to officers. They give the example of mobile phone mast data — where the filter could cut the required information down to just that about the person you need to know about.

This might sometimes be true. But two things make me suspect this is a highly partial story. For one thing, the search engine can tell you about the kinds of things it thinks it might tell you — perhaps social graphs, location histories, dodgy website visits, organisations supported — before you ask it. This is to educate and help police get the right information. It is also an invitation to make increasing use of the tool. If it is limited in its purpose, this seems an unnecessary step.

Secondly, there are no limits to what results the search engine might be asked to produce. Nothing for instance, says that only a single person or place can be searched against, so that only one person’s contacts might be returned, or just the people at a single crime scene. Thus the prospect of fishing trips is given no legislative limit. The only serious limit is that this information might be kept for no longer than 12 months.

For years privacy campaigners have been trying to explain how your web history and location data can be dangerous tools for personal and whole population surveillance. Now it seems the UK government wants to engage in a whole population experiment to show us what it really means. Parliament, the courts, but most of all, you, can help stop them.

[Read more] (1 comments)

March 15, 2016 | Jim Killock

Phone your MP and ask them to go to the IP Bill debate

Later today, MPs are debating the Investigatory Powers Bill in the House of Commons for the first time. The debate is expected at 12.45.

Can you call your MP's office now to ask them to go to the debate?

Call Parliament on +442072193000 and ask to be put through to their office giving your MP’s name.

Call your MP!

If you don't know who your MP is, type your postcode in on TheyWorkForYou to find out:

What to say
Remember you're far more likely to get to speak to a member of your MP's staff than your MP. Ask to speak to your MP and if they're unavailable, ask their staff member to pass on the message.

  1. Ask them to attend the debate
  2. Ask them to ask whether Internet Connection Records - the Home Office's proposal for getting Internet Service Providers to make a database of everyone's web browsing history - is really a secure, democratic and efficient way of detecting and investigating crimes
  3. Ask them to ask the Home Office minister to provide more than just an anecdotal case for bulk collection powers and Internet Connection records. We want to see costs and evidence.

Call your MP's office now

Call Parliament on +442072193000 and ask to be put through to their office giving your MP’s name.

Call your MP!

This is a big moment for surveillance in the UK. Let's make sure our MPs are asking the right questions. 

[Read more] (1 comments)

March 02, 2016 | Jim Killock, Pam Cowburn and Javier Ruiz

The revised Investigatory Powers Bill: what has changed

A revised version of the Investigatory Powers Bill was published today, less than three weeks after critical reports by the Intelligence and Security Committee and the Joint Committee, which had scrutinised the Bill. Together with the Science & Technology Committee, they made 123 recommendations. On first reading, it appears that the revised Bill has made minor revisions not the full redraft that many, including ORG, have called for.

There are two broad questions for Parliament. Firstly, do they agree that collecting records of everyone’s communications does not constitute a serious infringement of people’s privacy, and therefore cannot be regarded as mass surveillance. This is question of principle, which will inevitably be tested in court.

Crucially, the Home Office has presented an “Operational Case” for each power. This was a key demand from the Joint Committee - which they made because they felt Parliament needed to understand whether bulk data acquisition is necessary and proportionate. Without understanding what these programmes are used for, and what results they achieve, it is impossible to justify them.

However, while these present helpful information to Parliament, they lack the key requirements of an Operational Case: information that can help people work out if the programmes are worth the money, and how they compare with the alternatives such as targeted programmes of data acquisition. In any case, a process is needed to go through these and examine them, which should take place at the start of a legislative process, rather than near the end.

The second question is whether the Bill is fit for purpose, and whether it answered the criticisms made by the three committees.

ORG and the Don’t Spy on Us coalition published a summary of the Committees’ findings, which was emailed to MPs and peers to help them judge whether the amended Bill has addressed the flaws that have been identified.

What has changed?

Privacy: The ISC said: “privacy protections should form the backbone of the draft legislation, around which the exceptional powers are then built” and said that “one might have expected an overarching statement at the forefront of the legislation”. The Home Office response seems to have been to add the word “Privacy’ to a heading in Part One of the Bill.

Internet Connection Records: The revised Bill has extended police powers to monitor British citizens’ internet use. In the draft bill, the police were allowed to look at your use of internet communications services - such as messenger or chat applications - or whether you had accessed illegal materials. The new proposals give the police the powers to access any internet services, including cloud services where you don’t “communicate” with anyone else such as Dropbox, if they think it is relevant to an investigation. Access to ICRs still has internal sign off by public authorities without external authorisation.

ISPs raised concerns about lack of clarity about their obligations, but the final Bill does not help here. The Codes of Practice say: “The core information that is likely to be included are: an account reference, a source IP and port address, a destination IP and port address and a time/date. However, there is no single set of data that constitutes an internet connection record, it will depend on the service and service provider concerned.”

The filter: there has been no change to provisions for the ‘filter’ which could turn ISP data into an enormous population profiling engine. While the committees did not highlight this issue to the extent they could have, it remains a key concern.

Bulk interception and acquisition by GCHQ and MI5: The final Bill does not contain any fundamental changes and the wholesale tapping of fibre optic cables revealed by Snowden will continue as before. The agencies will also continue to obtain the phone records of everyone in the UK, plus soon our full internet histories. The final bill ensures that nothing is out of bounds by using more general words to refer to the intercepted content and data, now referring to “anything obtained under the warrant”. The agencies also gain more flexibility to modify warrants, separating the obtention of content and data, which can be changed without judicial approval during emergencies. 

Bulk personal datasets: Both the ISC and the JC called for class warrants to be removed but they have remained in the Bill. There is more detail on how Bulk Datasets warrants can be authorised and modified but no substantive restrictions. Judicial Commissioners can now order the retention or deletion of only part of a database.

The final bill makes clearer that warrants do not cover the obtention of databases - which relies on separate statutory powers - just their retention and examination. This is good for clarity, but raises more questions on how exactly the agencies obtain such databases when public bodies and private organisations are not compelled by law to collaborate.

Judicial authorisation of warrants: The system of “double-lock” remains in place with minor modifications. Ministers continue to authorise warrants with a “judicial review” by Commissioners. The period for emergency warrants to operate without approval from the Commissioners has been reduced to three days down from five.

There are some changes to the process for appointing commissioners and their operations, with more budgetary independence from the Home Office.

Privileged communications: The Bill is now peppered with references to legally protected communications, but the underlying protections remain too weak. Chairman of the bar Chantal-Aimée Doerries QC said: ‘The Bar Council is disappointed that the bill introduced to parliament today does not provide sufficient protection for legal privilege on the face of the bill. 

Encryption: Some small changes on the issuing of technical capability notices, which now cover removal of encryption applied “on behalf” of the operator. The obligations to support state hacking operations now applies to “telecommunications operators”, which can be both public or private.

Bulk hacking: Once more no changes other than closing potential loopholes to ensure that the agencies cannot miss anything, a recurrent theme throughout the new bill. Here the bill now refers to obtaining “any other information”, instead of “private information”. In case of doubt, the bill now clarifies that “any conduct which is carried out in accordance with a bulk equipment interference warrant is lawful for all purposes”.

[Read more] (1 comments)

February 22, 2016 | Ruth Coustick-Deal

Next moves for the IPB: Split, Delay or Publish?

Last week we heard three parliamentary committees' criticisms of the Investigatory Powers Bill (IPB). All in all they had 123 recommendations about changes that need to be made to the Bill. So what's next for this huge surveillance Bill?

 With criticism like that and their credibility undermined, we're expecting Theresa May and the Home Office to do one of three things with the Bill: Split it, Delay it or Publish it.

1. Split
They divide the Bill up into two or more different laws.

Theresa May is rushing to get the IPB on the statute book by December. The Data Retention and Investigatory Powers Act (DRIPA) - the law compelling ISPs to store our communications data for a year - expires at the end of 2016.

As DRIPA reaches its sunset, the Home Office wants to have another new law in place that keeps that arrangement going. They may take the data retention parts of the IPB and try to pass that separately from the rest of the Bill in the next few months. 

This would give them more time to make changes to the rest of the Bill. If they do this, they will have failed to pass a single comprehensive surveillance law - one of the Home Office's stated intentions when they first published the draft Bill. More importantly though, it's likely that they'd try to pass the new 'Snooper's Charter' parts of the draft IPB along with the data retention parts.

This would mean that we'd have a big fight on our hands in the next few months to stop the Government compelling the collection of the nation's web use.

2. Delay
They take into account the recommendations of the committees and delay the Bill so that they can re-draft properly.

Re-writing a better version of this Bill should take them some time. They will have to go back to the drawing board and make real changes that deal with the criticisms received from Parliament. They would also have to extend the sunset clause in DRIPA. This would likely be the best outcome for us, as it would give the civil servants more time to deal with the serious criticisms of the entire Bill such as the Intelligence and Security Committee's complaint that it was treating privacy as an add-on rather than the backbone of the Bill. 

3. Publish
They decide to press ahead, quickly make a few small changes to the draft Bill and present it to Parliament in the next few weeks.

If this happens we will wait for the new Bill to see what they come up with. But it's unlikely that they'll address all 123 recommendations - showing that they are rushing ahead without fully listening to concerns. This would be the worst possible outcome. The Home Office would be rushing through legislation that has been criticised from all quarters without consideration for the very reasonable complaints made by Parliament.

ORG and other civil society groups have been invited to meet with the Home Office later this week where we expect to get a better idea of what's going to happen. It will be a critical point where we'll learn what the future of this Bill will be and whether the Home Office has listened to the well-deserved criticism of the Bill. We'll write to update you about what's happening next.

[Read more] (4 comments)

February 11, 2016 | Pam Cowburn

Investigatory Powers Bill: Home Office needs to start again

The Joint Committee into the Investigatory Powers Bill was published today. It’s the third report in less than two weeks that calls for significant changes to be made to the draft Bill.

The Joint Committee report's is far from perfect - for example it accepts the Bill's weak proposals for judicial authorisation – but its 86 recommendations cannot be addressed with anything less than a full rewrite.

As Committee member Lord Strasburger puts it:  “It needs more than mere tweaking, it needs to be fundamentally rethought and rebuilt.”

Here are some of the key points:

Bulk surveillance powers

The report asks the Home Office to make the case for bulk surveillance powers and to show that their use could be compliant with privacy rights as these powers have the potential to be, “exercised in a way that does not comply with the requirements of Article 8 as defined by the Strasbourg court.”

It also points out that limiting these powers to overseas communications only could be pointless, given the global nature of the Internet.

Internet Connection Records

All three reports expressed concerns about how ICRs (Internet Connection Records) are defined and budgeted for. In addition, the Joint Committee stated it has “concerns about the definitions and feasibility of the existing proposal”.

The Committee's report calls for clarity about the definitions of ICRs, and admits it was not able to accurately assess the costs provided by the Home Office, which have been criticised as too low by several ISPs.

The Committee also rejected one of the key pieces of Government spin around for ICRs: “We do not believe that ICRs are the equivalent of an itemised telephone bill. However well-intentioned, this comparison is not a helpful one.” There is far more personal data available on our phones and computers than a telephone is ever able to gather.


The Committee says the Bill needs to be amended to make it clear that companies won’t be required to compromise encryption keys or install backdoors. It also says that the Government should, “make explicit on the face of the Bill that CSPs offering end-to-end encrypted communication or other un-decryptable communication services will not be expected to provide decrypted copies of those communications if it is not practicable for them to do so.”

Bulk personal datasets 

Bulk personal datasets (BPDs) are databases held by public and private organisations - for example, the electoral roll. The Committee found that the Government had not made the case for acquiring BPDs and said that the safeguards around them had not been explained properly. Like the Intelligence and Security Committee, they said that class warrants, which would allow the agencies to use one warrant to acquire multiple BPDs, should be removed from the Bill.

What's next for the Bill?

When Theresa May presented the draft Bill to Parliament, she said it was: “a modern legal framework which brings together current powers in a clear and comprehensible way”.

Three months later even she must recognise that claim no longer stands. The draft Bill needs to be completely rewritten and as the ISC suggested, the starting point should be privacy, which should be "the backbone" of this law.   We urge the Home Office to go back to the drawing board. 


[Read more] (1 comments)

: E-voting's Unsolvable Problem-->
  • ORG Glasgow: A discussion of the General Data Protection Regulation (GDPR)
  • ORG Aberdeen: March Cryptonoise event
  • ORG North East: Take control of your online life
  • ORG Cambridge: Monthly March Meetup