The nature and extent of internet activity have expanded exponentially since the coming into force of the Regulation of Investigatory Powers Act (RIPA) in 2000. This trend has had two contrasting consequences for the heated debates which have surrounded the Draft Investigatory Powers Bill. It is unarguable that citizens’ private lives and inner thoughts are now captured in communications technology to a far greater extent than previously. Intrusion by the state into this private sphere must only be done reluctantly and on grounds of necessity. At the same time, the movement of activity online includes criminal and terrorist activity, increasingly taking advantage of freely available technology which is by default encrypted. This second consequence has created new challenges for law enforcement and the security and intelligence agencies.
Resolving the tension between privacy and effective law enforcement in this area is no easy task. The Home Office has now come forward with a draft Bill which seeks to consolidate in a clear and transparent way the law enabling all intrusive capabilities. The Committee, together with the many witnesses who gave evidence to us, was unanimous on the desirability of having a new Bill.
The major change which would be brought about by the draft Bill is the creation of a new judicial oversight body and the much greater involvement of judges in the authorisation of warrants allowing for intrusive activities. As well as being important in in its own terms, making this change will reduce the risk that the UK’s surveillance regime is found not to comply with EU law or the European Convention on Human Rights. We make a number of detailed recommendations aimed at ensuring that this new system delivers the increased independence and oversight which have been promised.
A proposal which has attracted much attention from our witnesses is that of the creation of an obligation on communications service providers to collect and retain users’ internet connection records (ICRs). We heard a good case from law enforcement and others about the desirability of having such a scheme. We are satisfied that the potential value of ICRs could outweigh the intrusiveness involved in collecting and using them. But we also heard strong concerns, in particular from some of the providers themselves, about the lack of clarity over what form the ICRs would take and about the cost and feasibility of creating and storing them. The Home Office has further work to do before Parliament can be confident that the scheme has been adequately thought through.
Other concerns were over the provisions in the Bill for bulk powers to intercept, to acquire communications data and to interfere with equipment. These powers are not new, but have been avowed for the first time in legislation. The public debate over these powers is a healthy one, and the Home Office should ensure that it and the security and intelligence agencies are willing to make their case strongly in the months ahead.
We make a number of other detailed recommendations, including those aimed at ensuring that vital protections for lawyers and journalists are not compromised.
Much of the important detail about the way the new legislation will work is to be contained in a set of Codes of Practice. We call on the Government to ensure that these Codes are published alongside the Bill to inform the further scrutiny which the Bill will receive from the two Houses. In our view, the Bill would also benefit from a post-legislative review by Parliament five years after its enactment. We call for provisions for such a review to be included in the Bill.