Investigatory Powers: A Clean Bill of Health from MPs?

The prime minister has described the Investigatory Powers Bill as the most important piece of legislation in the current session. Since its publication in November, however, privacy and civil liberties groups, internet firms and communication service providers (CSPs) have all voiced concerns over different aspects of the draft bill. Proposals include obliging providers to store details of people’s access to Internet services (their Internet Connection Records, or ICRs), as well as explicit powers to hack computers and other devices.

The plans have been scrutinised by a number of committees of MPs and Peers and, to put it simply, they want more: more detail, more clarity, more explanation. Overall, they appear to accept the need for the powers contained in the legislation, but have demanded greater detail and clarity to satisfy their concerns. The government must now address their objections before it can begin to seek public support for the bill.

In January, the Commons Science and Technology Committee examined the technological issues associated with the draft bill, criticising the poor definition of a number of terms used, and raising concerns about the cost and feasibility of ICRs. Its particular fear was that the proposed obligations on UK businesses might place them at a relative commercial disadvantage to overseas competitors.

The tone of the report by the Intelligence and Security Committee released this week was more critical, taking many by surprise – and perhaps indicating a change in direction for a Committee which, in the past, has been criticised for not providing sufficiently rigorous oversight of the security and intelligence agencies. It was generally critical of the draft bill, and launched a scathing attack on the government for missing an opportunity to ‘provide the clarity and assurance which is badly needed’, and adopting a ‘piecemeal approach’ to privacy protection.

The report of the Joint Committee, consisting of seven peers and seven MPs, was always likely to be the most influential of the three; in 2012, it was a similar joint committee which stopped the draft Communications Data Bill in its tracks. This time the committee decided that the bill was on the right track, though its Chairman, Lord Murphy of Torfaen, warned that the government had a ‘significant amount of further work to do before Parliament can be confident that the provisions have been fully thought through’.

Its recommendations are numerous, but not insurmountable for the government. In broad terms, the Joint Committee appears satisfied that the government has struck a balance between the extent of the powers defined in the bill, and the authorisation and oversight mechanisms to prevent potential abuse. In relation to the use of ‘bulk powers’, for example, it states that ‘We are content that the safeguards proposed by the Home Office, buttressed by authorisation by Judicial Commissioners and oversight from the Investigatory Powers Commissioner, will be sufficient to ensure that the bulk powers are used proportionately’.

There are other victories for the government. The Joint Committee approved of the proposed ‘double-lock’ authorisation of warrants by both a Secretary of State and Judicial Commissioner. Equally, the retention of communications data by CSPs for a period of twelve months, and their access by local authorities, look set to be retained. The government’s proposal to build and operate a request filter – to seek data from multiple CSPs simultaneously – was not just endorsed but welcomed, with the Committee believing that the ‘technical and security challenges involved in implementing the Request Filter can be met’.

Perhaps most importantly, the Committee reflected favourably on ICRs, satisfied that ‘the potential value of ICRs could outweigh the intrusiveness involved in collecting and using them’. This is will be a significant blow to critics of the draft bill, who had hoped that what the government described as the ‘one new power’ in the bill would be struck down. In the end, the report actually suggests a possible expansion to their use by law enforcement.

It is not all good news for the government, however. The Committee made it clear that it needs to provide much more information on the definitions, costs and feasibility of the current proposals for ICRs. More broadly, all three reviews demanded that codes of practice should be published alongside the final bill, to provide detail on how the law should be interpreted and how the proposed powers will be used. Together, they suggest three major areas of improvement for the legislation itself.

The first, reflecting a common criticism by MPs, is that there needs to be much greater clarity on the definitions of terms used in the legislation. Some of these will be more straightforward than others. Even the Home Secretary seemed to agree that defining ‘data’ to include ‘any information which is not data’ was nonsensical, but the biggest headache for the government will be trying to define two of the purposes for which the powers can be used, ‘national security’ and ‘economic well-being’, which it has always been reluctant to do.

The second relates to the oversight regime. The Joint Committee was mystified as to why the government did not follow the recommendation of both the RUSI Independent Surveillance Review and David Anderson QC to create a commission with a clear legal mandate. It recommended that the commission should have an explicit power to instigate investigations on its own initiative, access technical expertise and refer any instances of wrongdoing directly to the Investigatory Powers Tribunal. It also suggested improvements to the process by which the Judicial Commissioners are appointed.

The third is in detailing the additional safeguards, reviews and business cases that the government needs to provide before the final bill can be laid before Parliament. These include, among other things, clarity on encryption provisions; the case for bulk personal datasets; how the legislation will apply to CSPs based overseas; safeguards over intelligence-sharing with other countries; further measures to protect legal professional privilege and journalists’ sources; a review of the Investigatory Powers Tribunal.

It is a long list, but requires the government to largely provide clarity and reassurance, rather than fundamentally rethink the powers themselves (which is fortunate, given that a new bill needs to be ready and tabled within a matter of weeks). The draft legislation may have received a few knocks from MPs but this is, after all, the point of the pre-legislative scrutiny process. The bill has a few more hurdles to overcome before it passes into statute, and the task is now for the government to provide the much-needed detail on its provisions, before it once again faces opposition from Internet corporations, civil society organisations, and finally the biggest hurdle of them all: public support.