What’s in the New UK Surveillance Bill?

images?q=tbn:ANd9GcTSqv1kpm2ddXNQ3s0fC9jkCGtd__Rgz5NsKQPDTjFtiDtxn8u6

The UK government intends wholesale reform, but will it perpetuate a dark history of invasion of privacy or follow the US example, and end invasive surveillance?

American opposition to mass surveillance is almost as old as the country itself: rejection of the use of “general warrants” to rummage through private homes was “the first act of opposition to the arbitrary claims of Great Britain”, according to John Adams, the US founding father. That sentiment came full circle when US surveillance powers were reduced for the first time this millennium, in the expiry of Patriot Act clauses used to justify the bulk collection of Americans’ phone records.

True to 18th-century form, Britain continues to use its modern “general warrants” to intercept digital communications en masse and has no intention of reducing powers anytime soon. In fact, chances are that we’ll soon see a new law in the UK extending, rather than reducing, surveillance powers.

It is now clear that the government intends to pursue wholesale reform of surveillance law in the UK in the guise of the investigatory powers bill, which the government, would like to see passed within a year. In some ways, this is a positive development: after two years of intense scrutiny by courts and committees, Britain’s legal framework for surveillance has been found desperately wanting, and a decision to overhaul surveillance law, rather than simply extend powers by attempting a revival of the snooper’s charter, raises the prospect that the government may be taking heed of some of the criticisms it has received.

On the other hand, the investigatory powers bill could well turn out to be the government’s attempt to correct the technical legal failings of the current framework, insulating it from the inevitable criticism of the European court of human rights, while acquiring even more invasive surveillance powers.

It is certainly not encouraging that the government has begun drafting the bill before publishing the report of David Anderson QC, an independent reviewer they themselves commissioned to assist in guiding surveillance law reform in Britain. This suggests that few of the criticisms levelled at the government, at the lack of transparency, disdain for accountability and disregard for democratic processes inherent in the current surveillance system, have been heeded.

Anderson’s report will be critical to this debate and expectations are high that it will propose bold reforms to surveillance law in Britain. There are at least five areas in which it is hoped Anderson, and ultimately the investigatory powers bill (which should reflect his recommendations) will suggest serious changes be made to the law of surveillance and investigatory powers in Britain.

Section 8(4) of the current law regulating surveillance, the Regulation of Investigatory Powers Act 2000, paired with other provisions is the law which – according to the intelligence and security committee (ISC) and the investigatory powers tribunal – allows the British government to conduct mass surveillance of every communication entering and leaving its shores. What the ISC terms “bulk interception” and believes is perfectly justifiable is, in fact, mass surveillance, indiscriminate monitoring of people in Britain and abroad, and must be halted.
Currently any proposed surveillance action is required to be signed off by a minister or his/her delegate, on the application of the intentions from a police or intelligence agent. Unlike many other countries surveillance in Britain is not overseen by a judge or a court of law, either of which, potentially brings an independent eye to bear on the exercise, of what can be and often are highly intrusive powers. According to the ISC’s February 2015 report, there are currently 19 warrants in place that cumulatively authorise the interception of billions of communications each day. None of those warrants were independently authorised prior to their issuance.

It is simply insufficient to accept that every decision to commence surveillance is ultimately a political one, requiring political judgment. The ultimate calculation of whether to commence surveillance, and thus interfere with privacy, must be a legal one, made by a competent, impartial judicial authority.

It should be well established by now that metadata, information about communications, is as valuable to the government as the content of those communications; on occasion it is even more so. Those who have attested to the value of metadata include the NSA’s general counsel Stewart “we kill people based on metadata” Baker, and the court of justice of the European Union. Accordingly, metadata must be afforded the same protections that are afforded to content; its collection should be viewed as akin to the interception of emails and the tapping of phones.

Using this as a premise, surveillance law reforms should roll back data retention, as mandated by the Data Retention and Investigatory Powers Act 2014, and refrain from enacting new communications data laws that would require communications service providers (CSPs) to collect third-party communications data (as was proposed in the previous snooper’s charter).
British law does not currently require the police or intelligence agencies to articulate any reason, beyond reference to broad goals of protecting national security or preventing crime and disorder, to commence interception of communications, either in a targeted or blanketed manner.

The fundamental starting point for any surveillance should always be the presence of a reasonable suspicion that a person or people are in some way deserving of having their rights violated. People should not be treated as suspects merely because they use the Internet; suspicion must come prior to interferences with privacy.

It will be a challenge but also a historical opportunity, a decisive moment in which Britain can follow the example of the US, and put an end to an era of pervasive surveillance, or continue to relive its dark history of general warrants and arbitrary invasions of privacy. If it chooses the latter, the government should again expect a revolt.

Guardian:  

« Got Good Cyber Insurance Cover? Beware of Holes in Your Policy.
Understand Mobile Deep Linking »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Ascentor

Ascentor

Ascentor specialises in independent information and cyber security consultancy. We’re experienced industry experts, providing cyber security services since 2004.

Galaxkey

Galaxkey

Galaxkey is a data protection product that protects email, documents and any data using access control and an encryption platform.

CSO

CSO

CSO serves enterprise security decision-makers and users with the critical information they need to stay ahead of evolving threats and defend against criminal cyberattacks.

Radisys

Radisys

Radisys offers software, products, integrated systems, and professional services for communication service providers and telecom solution vendors.

Radware

Radware

Radware is a global leader of application delivery and cyber security solutions for virtual, cloud and software defined data centers.

Infiltrate

Infiltrate

INFILTRATE is a deep technical conference that focuses entirely on offensive security issues.

Vitrociset

Vitrociset

Vitrociset design complex systems for defence, homeland security, space and transport. Activities include secure communications and cybersecurity.

SysTools

SysTools

SysTools provides a range of services including data recovery, digital forensics, and cloud backup solutions.

Cryptshare

Cryptshare

Cryptshare is a communication solution that enables you to share e-mails and files of any size securely.

Metrarc

Metrarc

Metrarc has developed a ground-breaking technology called ICMetrics™ for deriving secure encryption keys from the properties of digital systems without the need to store any of the encryption keys.

IT Career Switch

IT Career Switch

An IT Career Switch Traineeship is the easiest way to start a new career in IT or Cybersecurity with fantastic career prospects.

Selectron Systems

Selectron Systems

Selectron offers system solutions for automation in rail vehicles and support in dealing with your railway cyber security challenges.

Hushmesh

Hushmesh

Hushmesh is a start-up aimed at securing the world’s digital infrastructure by developing develop the Mesh, a global information space with automated security built in.

Judy Security

Judy Security

Judy (formerly AaDya Security) provides smart, simple, effective, all-in-one cybersecurity for SMBs. Get the 24/7 protection and support you deserve, at a price you can afford.

Complete Cyber

Complete Cyber

Complete Cyber provide professional cybersecurity services and products to help secure your infrastructure, systems and data.

BeckTek

BeckTek

BeckTek specialize in IT Cyber Security & Support, helping clients run their businesses faster, easier and more profitably.