The UK’s Investigatory Powers Bill will be taken back up in the House of Lords this week. The bill will provide invasive and broad authorities to conduct surveillance and undermine digital security. Particularly under a new agreement the UK is currently negotiating with the US government, the IP Bill will have the potential to harm human rights around the world.
In brief, it still codifies mass surveillance, undermines encryption, and authorises mass government hacking.
IP Bill re-cap
To remind you, the Investigatory Powers — or “IP” — Bill is a piece of UK legislation sponsored by Prime Minister Theresa May in her former capacity as Home Secretary that attempts to consolidate and update existing surveillance authorities. A draft version of the bill was released last year, and received broad criticism for, among other things, its grants of surveillance authority and mandates to ensure government access to sensitive user data. It was positively cited by Chinese government officials last year in support of its own new national security law. The bill was formally introduced earlier this year, and while the final version included some modifications, the changes failed to address some of its most egregious deficiencies.
Shortly after introduction, more than 200 lawyers wrote a letter explaining that the bill “fails to meet international standards for surveillance powers.” Despite this, the bill quickly made its way through parliament. There was assent in the House of Commons in June, and in July the bill made its way into the committee stage of the House of Lords. According to the UK government website:
During committee stage every clause of the bill has to be agreed to and votes on any amendments can take place. All suggested amendments have to be considered, if a member wishes, and members can discuss an issue for as long as they want.
There have already been three sittings at this stage, the most recent on 19 July. This week, the House of Lords will reconvene to again consider the bill before it is reported on and receives its third and final reading.
Still a bad deal
If passed the IP Bill will greatly expand the UK’s authority and ability to conduct surveillance. Though there have been several opportunities to adopt provisions to improve the IP Bill, legislators have retained its most invasive provisions without adequate protections for human rights. Here are just a few of the provisions that have made it past parliament’s “review” and are edging closer to law:
The UK IP Bill still…codifies mass surveillance
“Despite it being one of the most intrusive powers, the provision to capture and store all of our web histories for 12 months has not been scrutinised in this report. Liberal Democrats continue to be utterly opposed to this excessive and authoritarian measure that not only erodes our privacy but will likely to prove to be a waste of money and fall foul of our courts,” said Liberal Democrat Home Affairs spokesperson Alistair Carmichael.
Requirements to give notice to targets of UK surveillance are also specifically inadequate.
See for instance Part 6, Chapter 2, Paragraph 157, Subsection 1 and 2 of the current draft text.
The UK IP Bill still…grants authority to undermine encryption
“This is a vital power,” said Lord Howe of the ability to require the removal of electronic protection. “Without which the ability of the police and intelligence agencies to intercept communications in an intelligible form would be considerably diluted. Law enforcement and the intelligence agencies must retain the ability to require telecommunications operators to remove encryption in limited circumstances.”
See for instance Part 2, Chapter 1, Paragraph 157, Subsection 1 through 6 of the current draft text and further references to “technical capability notices”.
The UK IP Bill still… codifies mass government hacking
The Intelligence and Security Committee had this to say about “bulk equipment interference” warrants (which enable the UK to hack into the systems of large groups of people, locations, or organisations) in its report on the IP Bill: “The Committee has not been provided with sufficiently compelling evidence as to why the Agencies require Bulk Equipment Interference warrants, given how broadly Targeted Equipment Interference warrants can be drawn. The Committee therefore recommends that Bulk Equipment Interference warrants are removed from the new legislation.”
In addition, there is no requirement in the IP Bill for authorities to use less invasive techniques if they are available.
See for instance Part 6, Chapter 3, Paragraph 162-164 of the current draft text and further references to “equipment interference warrant”.
A global problem
Back in January we wrote about how the extraterritoriality provisions in the bill could give its most invasive provisions global impact. However, if the UK government has its way, these provisions may not even be necessary. That is because the UK is, right now, negotiating with the US government to enter into an agreement wherein the UK could serve UK surveillance orders, authorized under UK law, directly on US. companies (and vice versa). Because the US is home to most of the world’s major technology companies, this agreement would provide the UK with direct access to data on the majority of internet users around the world.
These negotiations are necessary because the current system — which revolves around the use of Mutual Legal Assistance Treaties (“MLATs”) — often fails to provide information that is necessary to legitimate foreign criminal investigations in a timely manner. However, any system that bypasses the MLAT process has to be designed to provide ample protections for human rights. Giving the IP Bill broad effect does not do so.
The UK is just one country that the US is likely to seek out these agreements with. However, before the any agreement can be entered, it is necessary for the US Congress to first amend US law, which currently prohibits the direct access being discussed. Draft legislation was recently released by the US Department of Justice (“DOJ”), which has already been broadly criticised for its failure to ensure that these agreements would require proper standards for government surveillance in order to protect rights. Importantly, while agreement would, ostensibly, provide some (inadequate) protections for US persons against by the UK and other countries, those protections would not extend to people living in the rest of the world, from Germany to India to Brazil.
Any agreement to expand the jurisdiction of the surveillance authorities in the IP Bill will have a major deleterious impact on global privacy. If passed as is, the IP Bill will likely increase criticism of the DOJ’s draft legislation, and certainly will undermine any potential for a US-UK agreement under that legislation in order to avoid the broad harm to human rights.
Call to action
Access Now once again urges the UK Parliament not to rush the passage of this broad, invasive bill. Barely six months have passed since it was formally introduced, and less than a year since we first saw the full draft bill. More time is needed to process the full implications of the complicated and nuanced legislation and to determine how to properly implement human rights protections, including competent judicial oversight and transparency. Substantial amendments will be necessary in order to bring the IP Bill into sync with human rights, and we urge full consideration of how best to discuss and implement those amendments.
We also urge people around the world who will be impacted by the broad authorities in the IP Bill to stand in opposition to its passage.