News Column

Cameron's surveillance bill makes a drama out of a non-existent crisis: Nothing justifies the data collection bill being pushed through now but it is an opportunity to ensure privacy is protected

July 11, 2014

Alan Travis Home affairs editor



There is no emergency that justifies rushing this urgent new "security" bill through parliament before its summer break but it could prove a major opportunity to bring the rise of the surveillance state under democratic control.

In order to ensure the continued access of the police and security services to the personal internet and phone-use tracking data held by the telecoms companies, they have had to concede important privacy and civil liberty safeguards.

Is there an emergency?

David Cameron says that since the European court of justice privacy ruling struck down on 8 April the EU directive that requires internet and phone companies to store their customers' communications data for 12 months, two problems were fast approaching. He said the legal uncertainty it has created meant that companies would soon start deleting the data rather than storing it and there was a danger they would start refusing requests backed by a home secretary's interception warrant

The former Tory shadow home secretary, David Davis, said: "I couldn't see quite what there was of an emergency here beyond a sort of theatrical emergency." He thinks the Home Office could have put the options before MPs any time since 8 April. The timing has also been dictated by the reactivation of a high court legal challenge to the blanket snooping powers by a British citizen backed by Liberty, the Open Rights Campaign and Privacy International, but this case is still likely to take several months more to resolve.

What is communications data and what did the ECJ say about it?

Communications data (metadata) is all the personal tracking data that is generated when we browse the web, send each other emails or texts or call each other on the phone. It is stored by the phone and internet companies for 12 months for possible access by the police and security services. It includes location data for mobile phones, which means it could be used to track your movements over the past 12 months.

The government has paid the internet companies pounds 65m to cover their costs of storing data since the requirement was introduced in 2009 in Britain in the aftermath of the 7 July 2005 bombings in 2005. The ECJ said the blanket collections of such data was like having the state looking over your shoulder, and it was possible to build up an entire picture of an individual's private life.

What do the police and security services use it for?

They say it has become a vital component in 95% of counter-terrororism, serious and organised crime and online child abuse investigations. Downing Street cited the examples of mobile phone evidence being used to catch the killers of Rhys Jones, to establish the network of the men who groomed young girls in Rochdale, and to make 121 arrests in a recent Europol child sex exploitation.

The problem is that the police and security services are not the only people able to access this powerful personal data. Nearly 600 public bodies can currently do so, including local authorities and the Royal Mail. They can access it for a wide range of purposes that go far beyond tackling serious crime and terrorism, including the extremely broad "economic wellbeing" of the country and a catch-all "any other purpose the secretary of state prescribes".

So what is the response to the ECJ ruling that has been agreed by the parties?

In the short-term they have agreed to rush through parliament in three days next week the five-clause emergency data retention and investigation powers (Drip) bill as a stop-gap. Importantly it will include a "sunset clause", so will expire on 31 December 2016.

In the meantime, the parties will try to thrash out a longer term agreement on what should be done to ensure the laws are updated to reflect rapid changes in technology while ensuring that civil liberties are no longer regarded as a luxury.

What will the bill do?

On communications data it will introduce some of the safeguards spelled out by the ECJ ruling. The court set out 10 principles on how to ensure that such blanket surveillance became proportionate to the threat, targeted and not open to misuse.

The detail of the bill appears to go only a short way in this direction. It will reproduce the specific list of purposes in the 2009 regulations but make clear that "economic wellbeing of the country" has to be linked to a specific national security threat and can't just be discovering what a rival international company are bidding for a particular contract. It also more sharply defines the types of data that can be kept and makes clear that in some cases the storage orders on the companies may be shorter than the current 12 months.

However the bill also makes clear for the first time that email forms part of the information that the companies will be required to hand over.

In addition to this, regulations are expected by Monday that will scale back the 600 public bodies who can currently ask for the data. An unknown number will be axed from the list. Local authorities will have to go through a single central authority before they can ask for data to pursue fly tippers or parking offenders.

More controversially, the bill will also clarify part of the Regulation of Investigatory Powers Act 2000 (Ripa) - the foundation stone of the surveillance state - to reassure overseas companies, particularly US ones such as Google, Twitter and Facebook, that UK jurisdictional powers apply to providers outside the country. Downing St insists this "extra-territoriality" clause is not an obscure backdoor to provide legal cover for the Prism and Tempura data harvesting programmes revealed by Edward Snowden.

But it is the longer-term measures that could prove crucial in unblocking the standoff between the state and privacy campaigners.

Those measures that could prove crucial in the longer term include:

* The "tip to toe" review of Ripa, the foundation stone of the surveillance state, to be completed by 2016, could prove particularly potent in ensuring that such state snooping in the name of counter-terrorism and serious crime is brought strictly under control.

It will issue an interim report before the general election on whether there are sufficient privacy safeguards in the post-Snowden age and whether there should be a major shakeup of the oversight regime for the security services.

* The creation of a US-style privacy and civil liberties board to ensure that civil liberties are a foundation stone of counter-terrorism legislation, rather than an afterthought. Bolstered by annual transparency reports from the state agencies, it could be the alarm system that the current oversight regime has failed to provide. It will effectively be a major expansion of the current one-man role of David Anderson, the counter-terror watchdog.

This is a major package, albeit rushed, that will shape how we live and work in the digital world. It may just "safeguard the existing position" - these powers have been in use in Britain since 2009 - but it also provides an opportunity to introduce some civil liberties elements that up until now were missing.

Captions:

The coalition says it is rushing through the legislation through in response to a European court of justice ruling as a stopgap measure - it has a 'sunset clause', meaning that it will be replaced after 31 December 2016 Photograph: Reuters


For more stories covering the world of technology, please see HispanicBusiness' Tech Channel



Source: Guardian (UK)


Story Tools






HispanicBusiness.com Facebook Linkedin Twitter RSS Feed Email Alerts & Newsletters