The Investigatory Powers Act – new weapons to fight crime & terror but at a cost to privacy

The Investigatory Powers Act 2016 came in with a degree of stealth, almost unseen, like a spy, which after all, is what it is.

There was some opposition after it passed into law but surprisingly little before. Several months after its passage there remains little debate over a law which provides enhanced powers to investigators and serious potential impact on privacy.

This Act sets out the extent to which certain investigatory powers may be used to interfere with privacy and created a framework to oversee the use of investigatory powers by law enforcement and intelligence agencies.

The powers afforded to law enforcement and security agencies (including the Metropolitan, GCHQ, the Ministry of Defence, HM Revenue and Customs, the Department of Health – 48 agencies in total), on the face of it, extensive under the Act which requires internet and communications companies to retain customers’ browser history for up to a year and protects the ability of security and intelligence agencies such as GCHQ and MI5 to bulk collect communications data and to hack in to a suspect’s electronic devices.

This also gives agencies the power to hack into mobile devices and networks without the owners knowing. This is a power not previously legally available to law enforcement and security agencies. It is called ‘equipment interference’ in the Act.

It does this by unifying the powers already available to law enforcement and intelligence agencies to obtain and collect communications and information and data from communications. A stated aim of the Act is to make these powers and the safeguards that apply to them clear and understandable.

The Act certainly adds in some safeguards as to how authorities can use these powers, using for example, a ‘double-lock’ for certain more intrusive warrants such as interception warrants. In the past the Secretary of State alone could give this authority. Under the Act further approval must then be given by a Judge.

In order to oversee how the powers are used and to give some assurance that they will be used proportionately an Investigatory Powers Commissioner has been created.

The Act has clearly been drafted so that it is not only fit for the digital age we are now in, but also future proof, for (and bearing in mind the rapid advances of technology) at least the next decade.

Understandably, the Act causes concerns about privacy and unauthorised access to private information. The Act imposes certain duties in relation to privacy and contains other protections for privacy and creates offences and penalties in relation to the unlawful interception of communications and the unlawful obtaining of communications data.

Further protections for privacy already exist and will compliment these new protections. They can be found, in the Human Rights Act 1998, the Data Protection Act 1998, the Wireless Telegraphy Act 2006, Computer Misuse Act 1990 and the common law offence of misconduct in public office. These law already deal with unlawful obtaining of personal data, interception and disclosure of messages, computer misuse offences and improper use of authority to unlawfully obtain information.

Whatever protections are in place, the view of individuals as to the purpose of the Act will invariably come down to their views on the integrity of law enforcement agencies and the State.

As Home Secretary, Amber Rudd gave the view of the Government “At a time of heightened security threat, it is essential our law enforcement, security and intelligence services have the powers they need to keep people safe. The internet presents new opportunities for terrorists and we must ensure we have the capabilities to confront this challenge.”

Tech giants such as Google and Facebook were critical of the Act stating it would have far reaching consequences for “the future of the global technology industry”.

Silkie Carlo a lawyer with Liberty, writing in the Independent (19.11.16) gives a clear idea of the suspicions with which no doubt many, will view the Act.

“Under the guise of counter-terrorism, the British state has achieved totalitarian-style surveillance powers – the most intrusive system of any democracy in history. It now has the ability to indiscriminately hack, intercept, record, and monitor the communications and internet use of the entire population. “

Are the concerns of Ms. Carlos justified? After all, if internet companies can retain customers’ browser history for up to a year (every website you have visited) and allows MI5 to bulk collect hack into phones….well are any of us safe? Forget debates about ID cards, forget physical surveillance these powers can potentially give more information about a suspect than a year of tailing them.

Well the good news is the powers cannot simply be used at will. There must be cause, this must be proportionate and with a Commissioner to oversee and a judicial process, it will not be without limit and certainly not totalitarian.

One interesting point is that the Act limits what data internet and communications companies are required to keep. This is limited to the metadata of web browsing and communications, NOT the content. Therefore the data may show a user logged into Facebook and looked at a profile but not the message they posted.

The Act actually introduces a greater level of transparency than almost any other country insofar as setting out what it can do. Most countries do not openly admit to using such powers and hide behind deniability and secrecy in the interests of the all-encompassing ‘National Security’.

Further, few can deny that law enforcement agencies cannot remain with analogue powers in a digital age. If they want to tackle terror, cybercrime, drugs and people traffickers, then they need to be intelligence led and they need these powers. Giving the powers legal sanction and operating them in a legal framework, with clear judicial safeguards protects society from misuse but at the same time, ensures that law enforcement agencies can do their jobs.

By way of example, the Act will let agencies legally install malicious software onto a suspect’s device that lets the agency download or copy information from it. Certainly an invasion of privacy but also a major tool in the arsenal of those fighting crime and terror.

Where Defendants in criminal proceedings faces evidence collected as a result of their powers, their lawyers will want to consider carefully how the information was obtained, that the correct authorities were given and that the powers were used proportionately and with necessity in the circumstances.

Essentially the Act legitimises the surveillance powers of law enforcement and security agencies but adding safeguards on how they obtain information about individuals without a warrant and who may not be under arrest.