Analysis: section by section

R.I.P. Bill to introduce far-reaching surveillance

The Bill will legitimise existing clandestine practices and introduce controls over encryption - all on the authority of politicians and officials

The Regulation of Investigatory Powers Bill has 73 clauses and 4 lengthy Schedules plus 357 points in the "Explanatory Notes". It is presented in three main sections: Part I - Interception of communications; Part II - Intrusive Investigation Techniques; Part III - Decryption powers.

Part I - Interception of communications

This section incomprehensibly starts with defining "unlawful interception" which covers interception by anyone not authorised by the state (Home Secretary, judge or a host of others). Though it makes "lawful" real-time interception (as it is happening) if carried out by a person who has the right to "control the operation or use of the system" or who has "the express or implied consent of such a person" (Article 1.6). This proposed lawful power extends to collecting and storing a communication that "is being, or has been, transmitted" or while being transmitted is "diverted or recorded" and to "data attached to a communication" (Article 2.7, 2.8, 2.9).

Article 3 plunges straight into "Lawful interception without a warrant" (both post and communications). It is lawful, without a warrant, if one of the parties (the sender or receiver) consents or if "surveillance.. has been authorised in Part II" (covert investigations).

Article 4 extends the categories where interception is "lawful" without a warrant. It covers prisons, hospitals and patients under the Mental Health Act 1983. It also covers any "business", which can by authorised by the Home Secretary by regulation, to monitor or record all communications conducted by that business. "Business" in this section is defined as including government departments, "any public authority" and any person given authorisation.

This Article also makes "lawful" the interception of communications in line with the EU draft Convention on Mutual Assistance in criminal matters without a warrant. It allows the interception of communications of a person in another country through telecommunications systems based in the UK due to an interception warrant issued in that country. No limits are placed on the use made of the intercepted material, ie: it does not have to be used for the grounds on which the interception was requested.

Article 5 finally gets around to dealing with instances where a warrant is needed for the interception of telecommunications and postal services.

Article 5.1.b. covers intercepting communications (post and telecommunications) at the request of a non-UK state or agency under an "international mutual assistance agreement". While Article 5.1.c. allows the Home Secretary to request interception of communications outside the UK. Article 5.1.d. covers "intercepted material" and "communications data" (electronic communications).

Article 5.1.3 sets out the criteria for issuing warrants: a) "in the interests of national security" (valid for up to six months); b) "for the purpose of preventing or detecting serious crime" (valid for up to three months); c) "for the purpose of safeguarding the economic well-being of the UK" (valid for up to six months, for people outside the UK); d) for international mutual assistance agreements.

Hidden at the back of this lengthy Bill in section 71 (2) and (3) is the definition of "serious crime". This includes:

conduct by a large number of persons in pursuit of a common purpose

The Explanatory note says this reflects Article 8 of the European Convention on Human Rights which refers to "disorder and crime".

The concept of "national security" is as usual not defined and is subject to the changing perceptions of governments, ministers and officials of all kinds. Liberty, observes: "If Parliament has not judged an activity sufficiently grave or insidious to justify bringing it within the criminal law, then it should not generally be regarded as a legitimate basis for interception or surveillance."

Article 5.6 says that an interception warrant covers "all such conduct.. as is necessary to undertake in order to do what is expressly authorised or required by the warrant."

Article 6 sets out the agencies which can request an interception warrant: MI5, MI6, GCHQ, NCIS, the police, customs, Permanent Under-Secretary at the Ministry of Defence plus non-UK states and agencies under mutual assistance. For international mutual assistance a "senior official" can issue a warrant where the person under surveillance is outside the UK (including "real-time" surveillance). Where it involves satellite telecommunications (Iridium-like "ground stations") warrants a senior official can issue a warrant "without further formality" as the UK is apparently not concerned with the validity or not of the warrant issued by the non-UK state or agency.

Article 8.3.b. provides that the Home Secretary has to issue a "certificate" setting out a "descriptions of intercepted material" required - this is directly relevant to telecommunications service providers. Article 11 sets out penalties for failure to cooperate: up to two years or an unlimited fine or both on indictment or up to six months or a fine or both in a magistrates court (summary conviction). Article 12 sets out obligations on service providers to assist in interception.

Articles 16 says that no reference or assertion may be made in any legal proceedings to the existence or not of an interception warrant. Article 17 allows exceptions for the prosecution and a judge to be shown the evidence - but not the defence.

Article 18 provides draconian sentences for people who reveal the existence of an interception warrant or the content of a communication or communication data (not the contents but the details of the sender and receiver of a message) revealed by the surveillance, including everyone who works for the postal service or for a telecommunications provider (including ISPs). This information is to be kept "secret" for all time. It provides for up to five years in prison or an unlimited fine or both on conviction.

 

Obtaining and disclosing "communications data"

Article 20 includes the definition of "communications data" as including "any information which includes none of the contents of a communication". This obscure definition can best be understood by looking at the categories of information set out in an EU document - ENFOPOL 98 (the EU-FBI surveillance plans). This says the law enforcement agencies need: the IP address, customer account no and address, logon ID and password used, PIN number, e-mail address and any credit card details. It would also details of messages sent and received and to/from whom. The Article also covers the postal services.

The Article allows for authorisations (as distinct from warrants above) and the serving of notices by "a person designated" (see below) on the following grounds:

a) "in the interests of national security"

b) "for the purpose of preventing or detecting crime or of preventing disorder"...

c) "in the interests of public safety"

The test here is quite different and simply defined as "crime" (not serious crime) with "disorder" added. It also covers protecting public health, collecting taxes, and "for any purpose.. specified.. by an order made by the Secretary of State" (Article 21.h, emphasis added).

Article 21.3 allows a person in a "public authority" (to be set out by the Home Secretary) to anybody else in the same authority to issue an authorisation/notice on a communications provider for communications data (for a period of up to one month, renewable).

Article 21.4 says that where it "appears" to the potentially thousands of "designated" people in public authorities that a "postal or telecommunications operator is or may be" (emphasis added) in possession of communications data they can serve a "notice" on them to obtain and disclose this to them whether "old" data or new data.

The assumption that access to communications data is a lesser intrusion into the rights of privacy that interception is unacceptable.

PART II:

Surveillance and "covert human intelligence sources"

The core of a surveillance state is the combination of intercepting communications and direct sources (informants and listening devices). Part II of the R.I.P. Bill makes lawful previous dubious and "unlawful" practices.

Three types of surveillance are to be "authorised":

a) "directed surveillance": this is so called on the grounds that "surveillance is directed if it is covert but not intrusive" (Article 25.2).

The grounds for issuing authorisations for "directed surveillance" include "national security", "preventing or detecting crime or of preventing disorder", and for "any purpose" laid down by the Home Secretary (Article 27.3).

The people able to issue authorisations are those "offices, ranks and positions with relevant public authorities" laid down (but not set out here) by the Home Secretary.

b) "intrusive surveillance": surveillance is "intrusive" if it is "covert surveillance". Surveillance is thus "intrusive" if a device (whether to record sound or video) is put in a "residential premises" (but by implication not if it is not a residential premises, like place of work or meeting place). It is intrusive if it involves as it is politely termed "an individual" (ie: undercover agent or informant). It is also intrusive if a listening device is in a vehicle, but it is not "intrusive" if a tracking device is attached to a vehicle to plot its location. However, it is "intrusive" if a "device" outside a premises or vehicle produces information of the "same quality and detail" as might be obtained from a device actually present in the premises or vehicles.

The grounds for issuing authorisations for "intrusive surveillance" include "national security", "preventing or detecting serious crime", and for "any purpose" laid down by the Home Secretary (Articles 30 and 33).

The people able to issue authorisations are "senior authorising officers" in the police, military or customs. Police and customs have to refer authorisations to the Surveillance Commissioner.

c) "the conduct and use of covert human intelligence sources": covers "inducing, asking and assisting" a source. What the term "inducing" means is not set out ("inducing" could include turning a blind eye to a criminal offence). The "covert" source is exempted from civil liability for "incidental" conduct (Article 26.2.a) and the "conduct" can be authorised for "conduct" outside the UK (the terminology is original). Although not spelt out "covert human intelligence sources" cover undercover agents, paid and unpaid, and "induced" informants.

The grounds for issuing authorisations for "the use of a covert human intelligence source" include "national security", "preventing or detecting crime or of preventing disorder" (a lesser standard than for "intrusive" surveillance), and for "any purpose" laid down by the Home Secretary (Article 28.).

The people able to issue authorisations are those "offices, ranks and positions with relevant public authorities" laid down (but not set out here) by the Home Secretary.

PART III:

Investigation of electronic data protected by encryption

This Section of the Bill introduces notices requiring service providers to disclose encryption "keys", known as a "section 46 notice". The grounds for such a notice include: "national security" and "preventing and detecting crime" (again a lesser standard). Failure to surrender a "key" could land a person in jail for up to two years or an unlimited fine or both. However, failure to keep "secret" the fact that a "key" has been given to a state agency can bring a jail sentence up to five years.

These proposals fail to address the fact that parties (sender and receiver) can encrypt messages "at source", the "key" in these cases would not be in the hands of the service provider. For a more detailed critique of Part III see: http://www.fipr.org.uk

Commissioners and the Tribunal

Two Commissioners are to be appointed, the Interception of Communications Commissioner and the Covert Investigations Commissioner as is a Tribunal (to hear complaints). The Tribunal, along the lines of the existing ones covering interception and the security services, has powers (to hear evidence without the complainant being present and to suppress any evidence which would endanger the "public interest" etc).

Conclusion

A number of overall comments need to be made. First, the concept of "crime" used to justify such surveillance. "Serious crime", used in the powers for interception, includes "conduct by a large number of persons in pursuit of a common purpose" which could be used against political groups and activists and/or demonstrations. In other areas there is the lesser test of simply "crime", any crime however minor. While the provisions on "communications data" and covert, undercover, surveillance are expressly extended to cover "disorder".

Second, the power, whether under warrants or authorisations, given to state agencies (police, customs, immigration, tax, health bodies and local authorities) to undertake surveillance amount to self-authorisation by politicians or officials. Liberty say:

Retention of executive rather than prior judicial authorisation of interception is fundamentally objectionable. That the executive should secretly authorise itself to commit clandestine interferences with important rights is neither acceptable or necessary.

Third, there is nothing to prevent the issuing of a warrant, authorisations or notices to cover an organisation or group and hence for the conducting of general surveillance ("fishing or trawling expeditions").

Fourth, the whole emphasis on the Bill is that the use of all these new legal powers is to be kept secret - and like the Official Secrets Acts the people involved have to take their "secrets" to the grave.

The fact that the Home Secretary has assured the nation that the R.I.P. Bill is in line with the European Convention provides little comfort. Nor will the appointment of two Commissioners, whose role will be defined by the open-ended powers given for surveillance. The Tribunal can be expected to be as toothless as the existing ones - which have never found in favour of a complainant. But then how can people know they are under surveillance, for proper or perverse reasons, if they never find out?

The Data Protection Working Party for the European Commission said in its report in May 1999 that:

a person under surveillance [should] be informed of this as soon as possible.

This would ensure a proper test of whether or not the surveillance was legitimate (see Statewatch, vol 9 nos 3 & 4). The government's analysis of the responses to it's consultation paper on interception says this is "an idea that law enforcement felt to be unworkable".

It may be a sad truism but too often this government when it lays down new legislation affecting civil liberties diminishes the rights of the people at the expense of the demands of "law and order" and the "law enforcement agencies", diminishing privacy and freedoms bit by bit and Bill by Bill.

Sources: Regulation of Investigatory Powers Bill; R.I.P. Bill Explanatory Notes; Regulatory Impact Assessment, Parts I and III; FIPR press release, 10.2.00; R.I.P. Bill: Second reading briefing, Liberty, 28.2.00; Interception of Communication in the UK, Consultation Paper, Home Office, June 1999; Interception of Communication in the UK: An analysis of responses to the governments' consultation paper (CM 4368), 15.12.99.

R.I.P. Bill Overview

UK Telephone-tapping and mail-opening figures, 1937-1998