In November 2015, in response to the criticisms and in an attempt to curb the modern day evils of child pornography and terrorism, the UK Government produced its draft Investigatory Powers Bill [pdf]. This aimed to give transparency and a new legitimacy to Government surveillance and mass data collection and retention operations.
The Home Secretary, Theresa May, in her introduction to the Bill, said:
“The means available to criminals, terrorists and hostile foreign states to co-ordinate, inspire and to execute their plans are evolving. Communications technologies that cross communications platforms and international borders increasingly allow those who would do us harm the opportunity to evade detection.
The use of investigatory powers is vital to locate missing people, to place a suspect at the scene of a crime or to identify who was in contact with whom. Powers to intercept communications, acquire communications data and interfere with equipment are essential to tackle child sexual exploitation, to dismantle serious crime cartels, take drugs and guns off our streets and prevent terrorist attacks.”
The Bill aims to formalise and restate pre-existing surveillance powers and law in a way which should be more transparent and which, in theory, should allow for greater democratic and legal oversight of the powers of the security and law enforcement services. The Bill includes provisions for the interception of communications, the retention and acquisition of communications data, the use of equipment interference, and the acquisition of bulk data for analysis. It will repeal and replace Part 1 of RIPA and DRIPA. It aims to “consolidate existing legislation and ensure the powers in the Bill are fit for the digital age”.
Deficiencies in the Investigatory Powers Bill
While the Bill (unlike RIPA) does include some explicit protection to journalists, those protections do not go far enough. The Bill provides insufficient safeguards for journalism and a lack of proper protection for journalistic material and confidential journalistic sources. A route has been created by which the state can potentially identify a source without going through the Art 10 compliant safeguards set out in PACE.
Part 3 of the Bill includes, at clause 61, a requirement for all applications to access the communications data for the purpose of identifying or confirming the identity of a journalist’s source to be authorised by a Judicial Commissioner. The Bill also requires that statutory Codes of Practice issued in respect of communications data must make provision for additional safeguards for sensitive professions. While it appears that access to journalistic content, for example their notebooks, will still be covered by PACE, communications data will not.
Communications data can now be obtained for a number of purposes (wider than those previously authorised under PACE) including for any crime (and not just serious ones) (clause 46(7)). The definition of communications data has been widely expanded. Clause 71 of the Bill empowers the Home Office to issue retention notices covering 6 categories of “relevant communications data”, of which one is “internet connection records” (ICR): Privacy International’s recent submission [pdf] to the Science and Technology Committee on the Bill, highlights the potential broadness of the categories of ICR data sought to be stored.
‘The retained data will potentially include the who, what, where, when, and how relating to every communication that a person has online. This includes, but is not limited to, visited websites, email contacts, to whom, where, and when an email is sent, map searches, GPS location, and information about every device connected to every wifi network in the United Kingdom, which includes Smart Tech such as Nest, iKettle, Smart Barbie, Amazon Echo, and others. The sheer volume of retained data will be huge.’
This of itself raises issues about how and where such data will be safely and securely retained and stored. Arguably, the width of these retention powers fails to comply with the EU Charter on Fundamental Rights and is disproportionate.
A serious weakening of protections for journalists’ sources
Clause 61 does not meet the standards set out in PACE, which provides a clear process with proper judicial scrutiny:
- The so-called “judicial authorisation” that is proposed will be after the fact. Further, a judge will only able to assess whether the police have “reasonable grounds” for the intrusion – this is merely a review of a police decision, already taken, against an extremely broad standard: the appropriate test should in cases concerning human rights be one of necessity and proportionality, not reasonableness (see g. Miss Behavin’ Ltd [2007] 1 WLR 1420).
- This will not be an “inter partes” process – the judge will not hear from the media in it. Furthermore, this weak authorisation process can be bypassed in urgent situations. For the same reasons DRIPA was found wanting by the CJEU in Digital Rights Ireland, this so-called “double lock” provision is inadequate.
- The authorisation requirement applies narrowly to material where the application is for the purpose of identifying a journalistic source. This wouldn’t cover other details acquired by a journalist for the purposes of a sensitive journalistic investigation, for example unpublished material – which is covered under PACE or where a source is stumbled upon accidentally.
- Applications to the judicial commissioner will be made without the knowledge of the media concerned: “in making an application for data to identify a journalistic source, the applicant is not required to notify either the person to whom the applications relates i.e. the journalistic source, nor that person’s legal representative”. So there is no prior notice and further, there is no right of appeal.
- The Bill contains no reference to a right of source protection that can only be displaced by an overriding public interest – for example under the Bill, data can be obtained for any number of reasons, including investigation of any crime, however minor.
- In contrast to PACE, there is no requirement that the police exhaust other lines of inquiry.
- There is no judicial oversight of data collection involving journalists or journalism if the purpose of the application is for any other reason than identifying a source. It is often the case that identifying a source is collateral or incidental and safeguards need to be in place for those occasions.
- The proposed procedures don’t apply to applications made to access journalistic communications by the intelligence and security services.
There are also other measures in the Bill which are not targeted at journalists specifically, but which appear to pose a threat to the practice of journalism more broadly:
- Encryption of communications is vital to ensure the security of journalistic communications and information, including about sources, particularly in the field of investigative journalism. The anti-encryption provisions in clause 118, 4(c)1 of the draft Bill create an overall weakening of the encryption framework that could lead to third parties being able to access encrypted data more easily.
- The “equipment interference” proposals (the capability for security services and the police to remotely “hack” technology) permits, for example, the police to access a smart phone and use its microphone covertly to record sound, without the knowledge of the owner. This practice was already being used by the security services, but the parameters will now be defined in statute. A judicial warrant will be necessary, and a code of practice will be brought in to regulate “the use of more sensitive and intrusive techniques”
- Part 2 of the Bill relates to the Lawful Interception of Communications. Clause 13 of the Bill relates to, inter alia targeted interception warrants. RIPA provides that such warrants are to be targeted at “one person as the interception subject” or “a single set of premises” (clause 8(1)(a)). Clause 13(2) of the Bill allows for a much wider, less focused warrant to be obtained in respect of, “A group of persons who share a common purpose or who carry on, or may carry on, a particularly activity”. It does not require specific individuals to be named. This appears to be equivalent to the instrument known as “the general warrant”, which was held to be unconstitutional in Leach v Money (1765). This followed a practice in the eighteenth century of the state using “general warrants” against the “authors, printers and publishers” of a named periodical – in this case the warrant was directed against the authors, printers and publishers of the North Briton, (the mouthpiece of John Wilkes). More recently, the Grand Chamber of the ECtHR in Zakharov v Russia stated that “the interception authorisation, … must clearly identify a specific person …or single set of premises”. Protection for these warrants being used against MPs is included (cl 16(1)(b)), but there is no equivalent protection for sensitive professions such as the legal, medical, journalistic professions. Further, such warrants may be issued in urgent cases (cl 20) that do not have to be approved by a Judicial Commissioner. Warrants may be modified in quite significant ways (by adding names or premises) and this modification does not require the judicial commissioner to approve it (cl 26).
- Part 2 also permits interception of communications in prisons if such a power is conferred under the prison rules (cl 37). However, no provision appears to be made n the draft Bill to protect legal privilege or any such communications with journalists.
- Part 4 relates to the retention of communications data. Part 9 deals with definitions. A telecommunications operator – a term used throughout the bill – is defined extremely widely, applying to a person who offers or provides a telecommunications services or controls or provides a telecommunications system which is wholly or partly in the UK or controlled in the UK. This definition appears to deliberately bring public and private operators within the scope of the Bill. There are some cases where the Bill appears to refer specifically to public operators but in other parts of the Bill it applies to both public and private operators (so it could potentially apply to the Guardian). The implications of this for a journalistic organisation are very concerning.
- Part 5 is about authorising interference with equipment. Again there are specific measures to protect MPs from this sort of warrant, but none for other sensitive professions such as journalism or the law.
- Part 6 concerns Bulk interception and acquisition warrants. These bulk interception warrants can sweep up both domestic and overseas material. These also seem to apply to both public and private telecoms operators. Again there are no protections accorded to journalists (not even akin to those conferred in Part 3 under clause 61).
Covert surveillance
Finally, it is worth noting that Part 2 of RIPA (which deals with covert and human surveillance) is not being repealed or altered. In 2008, the Chief Constable of Thames Valley Police granted authorisation under Part II RIPA for his officers to place a probe inside the car of one of their officers, who they suspected of being a source for a journalist called Sally Murrer, who worked for the Milton Keynes Citizen. This enabled his discussions with Ms Murrer to be recorded.
On the back of these recordings, the police arrested Ms Murrer and strip-searched her. They searched both her home and her desk. She was charged with aiding and abetting the alleged misconduct of the officer said to have disclosed information to her. Once prosecuted, she was entitled to disclosure of the papers relating to the Chief Constable’s authorisation and the approval of that authorisation by a Surveillance Commissioner (a retired judge). These papers made no reference to the fact that she was a journalist or that the investigating officers were seeking to identify a confidential journalistic source. The prosecution was eventually halted after the Court recognised that the procedures used constituted a violation of fundamental journalistic rights.
Conclusion
No one seriously disputes that law enforcement and intelligence agencies needed to have investigatory powers, which may be intrusive, and may need to be secret. There is, however, a particularly delicate balance to be struck in protecting the public from genuine threats to security while safeguarding fundamental rights such as freedom of expression and the right of journalists to protect their sources. Regrettably, the Bill singularly fails to achieve this.
Gill Phillips is the Director of Editorial Legal Services at Guardian News & Media