Bulk Powers In The Investigatory Powers Bill: The Question Of Trust Remains Unanswered BULK POWERS IN THE INVESTIGATORY POWERS BILL: The Question Of Trust Remains Unanswered September 2016 1/10 Bulk Powers In The Investigatory Powers Bill: The Question Of Trust Remains Unanswered Introduction We are on the brink of introducing the most pervasive and intrusive surveillance legislation of any democratic country in the world. The Investigatory Powers Bill sought to answer important questions about the place that modern and highly intrusive surveillance capabilities have in a democratic society, questions that were raised by the Edward Snowden disclosures in 2013 and subsequent reports produced by David Anderson QC, the Royal United Services Institute (RUSI) and the Intelligence and Security Committee (ISC) in 2015. But just a matter of weeks before the new law is enacted, significant questions of trust remain unanswered. This paper highlights some of the key flaws Privacy International sees in the current incarnation of the Investigatory Powers Bill, and urges the House of Lords to put the brakes on the bulk powers, about which many important questions remain unanswered. In this paper we set out how: • the Bill fails to provide sufficient clarity, which was promised at the outset of the legislative process, to alleviate confusion around the UK’s surveillance laws; • the Bill has not advanced transparency to the degree needed, still leaving most of the public in the dark about the extent of the surveillance powers; • significant questions remain about the Bill’s safeguards and oversight regime; and • major questions also remain regarding the bulk powers, even in light of David Anderson QC’s recent report. The points we raise lead to a single recommendation for consideration by the House of Lords. Because of the significant questions that remain unanswered, we urge the House of Lords to introduce a series of amendments that will remove the bulk powers contained in the Bill. 2/10 Bulk Powers In The Investigatory Powers Bill: The Question Of Trust Remains Unanswered 1. The proposed Bill adds to our already confusing and impenetrable surveillance laws In an oft-quoted section of his 2015 report on the investigatory powers regime, David Anderson QC declared: “Obscure laws – and there are few more impenetrable than RIPA and its satellites – corrode democracy itself, because neither the public to whom they apply, nor even the legislators who debate and amend them, fully understand what they mean.”1 Anderson went on to say that many of the current surveillance laws are “so baldly stated as to tell the citizen little about how they are liable to be used.”2 The Investigatory Powers Bill was thus introduced with a goal of improving transparency and enhancing the safeguards that apply to modern surveillance.3 Unfortunately, it has fallen far short of those goals. The Bill is over two hundred pages long, and filled with vague language, confusing definitions and catch-all powers, like national security notices, that leave even experts confused as to what activities the Bill may permit in the future.4 The Bill also leaves in place most of the “obscure laws” criticised by Anderson, including significant portions of the Regulation of Investigatory Powers Act 2000 (RIPA), and the Intelligence Services Act 1994 (ISA). Indeed, the Intelligence and Security Committee (ISC) has criticised the Bill for encompassing only certain types of equipment interference (EI), while allowing “different forms of EI . [to] continue to sit under the broad authorisations provided to the Agencies under the [ISA].”5 In the past, the intelligence services have demonstrated their predilection for using the law that is most convenient, not necessarily the one that is most transparent.6 In this context, leaving RIPA, the ISA and other related acts in place while adding the Investigatory Powers Bill into the mix will only increase confusion. 2. The Government has failed to be transparent with the public about how it will intrude on their privacy • The public does not understand or give consent to the Bill It is important to recognise that the Investigatory Powers Bill is a materially different piece of legislation to the one that the Conservative Party’s 2015 election manifesto indicated would be put forward.7 The manifesto states “we continue to reject any suggestions of sweeping, authoritarian measures that would threaten our hard-won freedoms”.8 Despite this assertion, the bulk powers that are the foundation of this Bill amount to nothing short of a mass surveillance apparatus, and suspicionless collection and retention of the personal data of an entire population is a profound and dangerous antithesis to democratic principles and values. 1 A Question of Trust: Report of the Investigatory Powers Review, June 2015 ¶13.31 2 A Question of Trust: Report of the Investigatory Powers Review, June 2015 ¶13.31(a) 3 Draft Investigatory Powers Bill, November 2015, Forward from the Home Secretary 4 See, for example, Graham Smith, “The content v metadata contest at the heart of the Investigatory Powers Bill” 26 May 2016, available at http://cyberleagle.blogspot.co.uk/2016/05/the-content-v-metadata-contest-at-heart.html 5 Intelligence and Services Committee, Report on the draft Investigatory Powers Bill, 9 February 2016, ¶11-13. 6 Privacy International, “New documents reveals that GCHQ and MI5 stretched law to breaking point” 6 June 2016, available at https://www.privacyinternational.org/node/872 7 The Conservative Party Manifesto 2015, available at https://www.conservatives.com/manifesto 8 The Conservative Party Manifesto 2015, p. 61 3/10 Bulk Powers In The Investigatory Powers Bill: The Question Of Trust Remains Unanswered Indeed, the manifesto recognises that the power that should be maintained is “the ability of the authorities to intercept the content of suspects’ communications, while continuing to strengthen oversight of the use of these powers”.9 Yet, Part 6, Chapter 1 of the Bill is devoted to bulk interception, which inherently involves the interception of communications of people both abroad and in the UK who are not suspected of any crime. The far-reaching bulk powers contained within the Bill affect literally everyone in the UK but public knowledge of the Bill - and even a rudimentary understanding of its impact on the privacy of everyone’s personal data - is extremely low. According to a ComRes poll commissioned by Liberty in June 2016, 72% of people polled have either never heard of the Investigatory Powers Bill or know nothing about it.10 In the same poll, ninety percent of the public either said it is only acceptable for the Government to access and monitor records of their emails, text messages, phone calls and online browsing history if they are suspected of or have committed a crime – or say this practice is never acceptable. Most fundamentally, nine out of 10 British adults polled believe state surveillance powers proposed by the Investigatory Powers Bill are not acceptable. A manifesto commitment that has been greatly exceeded and a lack of public understanding and support for the Bill demonstrate the Government’s failure to secure a proper democratic mandate for a law that rewrites the contract between the state and the citizen. • Powers vs programmes The conversation around the Bill has also suffered from a failure to address some of the ways in which the bulk powers may operate in practice. While the police and intelligence agencies’ capabilities were revealed in broad strokes with the introduction of the Bill, many questions about how those powers actually operate remain unanswered. Despite the publication of hundreds of pages of draft legislation, explanatory notes and codes of practice, the Government has explained very little to Parliament or the public about the nature of the bulk operations. As such, the legislation remains abstract, and lacks clarity and transparency about the specific capabilities Parliament is on the verge of sanctioning. Indeed, it may only be through examining known operational capabilities that a full understanding of the bulk powers can be ascertained. For instance, the Snowden disclosures reveal that through a programme codenamed ‘Optic Nerve’, the Government Communications Headquarters (GCHQ) had collected screen captures of 1.8m Yahoo webcam users.11 Such widespread collection was disturbing both because of its scale and the extremely private and intimate nature of some of the images obtained, which were described as containing “substantial quantities of sexually explicit communications.”12 9 The Conservative Party Manifesto 2015, p. 65 10 Liberty, “Ninety per cent of Brits believe Government surveillance powers contained in new Snoopers’ Charter are not acceptable, new poll finds” 5 June 2016, available at https://www.liberty-human-rights.org.uk/news/press-releases-and-statements/ninety-cent-brits-believe-government- surveillance-powers 11 Ackerman and Ball, “Optic Nerve- millions of Yahoo webcam images intercepted by GCHQ,” The Guardian 27 February 2014 12 Ackerman and Ball, “Optic Nerve- millions of Yahoo webcam images intercepted by GCHQ,” The Guardian 27 February 2014 4/10 Bulk Powers In The Investigatory Powers Bill: The Question Of Trust Remains Unanswered Under the Investigatory Powers Bill, it is very possible that a programme like Optic Nerve might continue pursuant to a bulk interception warrant. The debate around the Bill has provided no assurances this won’t happen, in part because of the Government’s continuing