The Investigatory Powers Act dubbed the Snoopers charter by critics was passed by parliament last year, gaining royal assent in Novemberas the government sought to shore up capabilitiescontained within earlier emergency surveillance legislation, akaDRIPA, whichcontaineda sunset clause, meaning thosepowers expired at the end of 2016.
DRIPA was branded draconian and undemocratic when it was rushed through parliament with minimal scrutiny. The IP billfared little better, attracting criticism about its impact on privacy and overly intrusive powers from even the hawkish Intelligenceand securitycommittee.
And despite what was technically a lengthier parliamentary scrutiny process than DRIPA,critics continued towarn thelegislation handed unprecedented surveillance powers to the authorities with inadequate checks and balances to protect privacy and civil liberties.
The IP Act also expands on the investigatory capabilities enabled byDRIPA by including a provision to require ISPs to log all the websites and services that all users connect to for a full yearso that the information can be provided to authoritieson demand including to a wide range of government agencies (not just to security andlaw enforcement agencies). No warrant is needed for accessing thedata.
This is one of the bulk powers Liberty is objecting to in its planned High Court challenge, warning that these so-called Internet Connection Records (ICRs) provide a goldmine of valuable personal information for criminal hackers and foreign spies.
It also wants a High Court judicial review of three other bulk powers enshrined in the IP Act thatit argues also breach the publics rights namely:
- Bulk interception the power for the state to read digital communicationsand listen in on calls en masse, without the need for there to be anysuspicion of criminal activity
- Bulk hacking aka the ability for police and security agencies to access, control and alter electronic devices such ascomputers, phones and tablets on what Liberty dubs an industrial scale, regardless of whether their owners are suspected of involvement in crime leaving them vulnerable to further attack by hackers
- Bulk personal data sets aka the ability for agencies to acquire and link large databases held by the public or private sector. These contain details on religion, ethnic origin, sexuality, political leanings and health problems, potentially on the entire population and are ripe for abuse and discrimination, argues Liberty. This power was only avowed to parliament in March 2015
Commenting on thelegal challenge in a statement, Libertys director, Martha Spurrier, said: Last year, this government exploited fear and distraction to quietly create the most extreme surveillance regime of any democracy in history We hope anybody with an interest in defending our democracy, privacy, press freedom, fair trials, protest rights, free speech and the safety and cybersecurity of everyone in the UK will support this crowdfunded challenge, and make 2017 the year we reclaim our rights.
A spokeswoman for Liberty said it is aiming to raise at least 10,000 via the Crowdjustice platform to help cover our costs exposure.
She noted that more than 200,000 people have already signed a petitioncalling for the IP Act to be repealed, adding: Were very confident that well raise this money, but we will explore other funding options if we dont reach our target.
Libertys legalchallenge to the IP Act follows a keydecisionby Europes top court last month, when the ECJruled that EU Member States cannot impose a general obligation to retain data on providers of electronic communications services.
EU law precludes national legislation that prescribes general and indiscriminate retention of data, the court stated.
As well as indiscriminate data retention, the court objected to DRIPAs failure to limit access to the data to the prevention and detection of serious crime; to the legislation allowing police and public bodies to authorize their own access to the data; to the lawnot requiring that people be notified after their data was accessed; and not requiring that data be kept in the EU.
The ECJ ruling was sparked bya legal challenge brought against the now sunsetted DRIPA, but has clear implications for the IP Act, given how many bulk powers are contained within the U.K.s replacement surveillance legislation.
Were very confident the High Court will rule that the powers were challenging are unlawful the powers in DRIPA already ruled by the ECJ to breach rights have been replicated and expanded on in the IPA, said the Liberty spokeswoman.
Its quite difficult to make an estimate on the timeframe because it depends on the courts, but we would expect to have an initial hearing with the High Court within the year, she added.
Some of thebulk powers contained with the IP Act were subject to a reviewlast summer byQC David Anderson, the U.K. governments independent reviewer of terrorism legislation. Although, at the time, Liberty criticized the small window of time afforded by the government for the review and pointed out that twoof the appointed advisers had close links with the security and intelligence agencies that were lobbying for the powers.
Andersons review went on toback the bulk powers inclusionin the legislation, arguing there is a proven operational case for three of the bulk powers [bulk interception, bulk acquisition and bulk personal dataset], and that there is a distinct (though not yet proven) operational case for bulk equipment interference [aka hacking].
Hisreview did not consider the proportionality or desirability of the bulk powers leaving that for parliament to judge. Nor did he assessbulk data gathered by ICRs.
Blogging aboutthe ECJ DRIPA data retention ruling last month, Anderson described it as a genuinely radical judgement, and notedit has significance for the IP Act likely meaning the law will have to be amended by further primary legislation or by a statutory instrument (secondary legislation).
In a final thought on the ruling hewrites: This important judgment is bound to feature in law exams across Europe this summer. If I were setting a question,it would be this one: Lives are ruined by crime, not by the properly safeguarded use of general data retentionto fight crime. Discuss.
That questionwillcontinue to be debated in many forms and for many years. It is to be hoped thatthose debateswill generate lightas well asheat. For this to happen, the participants legislators, courts, NGOs, academicsand students need to avoid trading prejudices,and instead make productive use ofthe increasing evidencebase relating toboth the harm and the utility of bulk data retention.