Investigatory Powers Bill

Written Evidence submitted by HUBS CICS (IPB 53)

HUBS Written Evidence – Investigatory Powers Bill

Summary. Many of the obligations and duties of telecommunications carriers that would be introduced by the proposed Investigatory Powers Bill do not make sense in the context of micro ISPs operating in rural and remote environments. The bill contains a new power for the secretary of state to make orders for classes or descriptions of providers to take some action whereas the present legislation provides only for orders to apply to a specific entity. We therefore propose an amendment for a de minimis exception where an order is made on such a class or description of providers.

1. My name is William Waites. I am a founder and director of HUBS CIC, a Scottish Community Interest Company whose purpose is to facilitate broadband provision in rural and remote parts of the country outwith the reach of the large, well-known carriers. This submission is made on behalf of HUBS CIC.

2. HUBS' members are small Internet Service Providers typically with tens to hundreds of individual end-user subscribers each. Together they provide the only available Internet service in large swathes of the West Highlands and the South of Scotland.

3. HUBS does not provide service to end-users but instead makes bulk Internet services available to its members that would not otherwise be obtainable due to their small size.

4. This evidence is about how the data rentention requirements of the draft Investigatory Powers Bill in particular, and the new obligations and duties on Telecommunications providers in general relate to service providers operating in the environment of HUBS' membership.

5. It appears from the draft bill that data retention obligations may be placed on a class or description of entities. If micro providers such as make up HUBS membership were to fall into this class, it would place a disproportionate burden on them.

6. A typical member's entire network infrastructure will cost on the order of tens or hundreds of thousands of pounds. It is optimised for lightweight, energy efficient operation. There are no data centres or indeed cabinets that have adequate physical security for safely storing the most intimate records of individual's on-line activities.

7. Indeed it is recognised in general that keeping sensitive data secure is so important, that the best way to meet this obligation is simply to not record it.

8. Constructing facilities in each of these service providers to extract, record, securely store and make available any `Internet Connection Records' (assuming that such a thing existed) would cost at least as much as their entire infrastructure.

9. HUBS, though it is designed to enable the micro ISPs to benefit from economies of scale, cannot help here because it does not know the individual end users. The use of IPv4 NAT in member networks is common and it is not possible from HUBS' vantage point to separate traffic of different users.

10. Due regard should also be given to the social dynamics. If an ISP has a couple of dozen subscribers, two or three of which are actively involved in operating the network, data retention has a very different flavour. It is more like people being required to spy on their neighbours. In a large carrier, where your customers are not likely to be your neighbours, it might be easier by virtue of social distance to avoid facing the moral and ethical problems that arise.

11. Similar considerations arise with the provisions relating to interference or obtaining data. That by virtue of being a telecommunications service provider (which HUBS members are by any reasonable reading of the definitions) they can be required to do a wide variety of acts such as stealing data from or causing equipment that belongs to their neighbours to misbehave, perhaps by borrowing their mobile telephone at the local cafe and implanting spyware onto it.

12. Almost any application of the provisions of the bill requiring actions by service providers take on a bizarre and very problematic appearance when considered in the context of small rural ISPs. Even targetted interception would have to work differently in a small village where everyone knows everyone else, including the operator of the network. The proposed law is clearly designed for a very different environment from that of HUBS' members.

13. We therefore propose that the bill be amended such that, where a class or description of telecommunications operators is required to do some thing under this law, that it automatically includes a de minimis exception where providers with fewer than some number of subscribers (say 50,000) are taken to be not included.

April 2016


Prepared 6th April 2016