http://www.statewatch.org/news/
UK: Legitimising surveillance
The Regulation of Investigatory Powers Bill [R.I.P.
Bill]
In June 1999 the Home Secretary put out a consultation paper on the
interception of
telecommunications prior to publishing a Bill to replace the 1985
Interception of
Communications Act (IOCA) (see Statewatch, vol 9 no 3 & 4). This dealt
primarily with
state agencies intercepting phone-calls, e-mails and faxes. On 9
February the "Regulation of
Investigatory Powers Bill" (RIP Bill) was introduced. The title of the
Bill can only be described
as deliberately misleading, placing the emphasis on the "Regulation"
rather than on the
extensive new powers of surveillance being legitimised. It covers:
- the interception of telecommunications (including the exchange of
data with third
states/agencies)
- intrusive surveillance (on residential premises and vehicles)
- covert surveillance
- the "use of covert human intelligence sources" (agents, informants,
undercover officers)
- power to demand communications data (eg: billing details)
- power to order the handing over of encryption "keys"
Home Secretary, Jack Straw, said: "None of the law enforcement
activities specified in the Bill
are new. Covert surveillance by police and other law enforcement
officers is as old as policing
itself; so too is the use of informants, agents and undercover
officers." The Home Secretary is
thus, at a stroke, seeking to legitimise all the current practices of
the "law enforcement
agencies" which are currently unregulated and in most cases not covered
by law.
There may be nothing "new" but there are certainly practices in the
Bill which should have
been the subject of democratic control and scrutiny. There are a host
of new surveillance
powers in the Bill which have not been put out to consultation but
simply added to the
proposed legislation.
The scope of the new surveillance powers reflects the changing nature
of "policing", not just in
the UK but in most EU countries. Over the past ten years secret and
clandestine methods of
gathering "intelligence" previously employed in the days of the Cold
War by internal security
agencies have permeated policing practice. According to the Home Office
the Bill will enable
the law enforcement agencies to conduct systematic targeting of an
individual over a period of
time in order "to obtain a picture of his life, activities and his
associates."
Another driving force behind the provisions in the Bill is the EU draft
Convention on Mutual
Criminal Assistance (which covers interception and covert operations)
and the "requirements"
set out in the EU-FBI telecommunications surveillance plan adopted by
the EU in January
1995.
Liberty has commented that:
the clandestine nature of the operations regulated by the legislation
heightens the care
needed to ensure that necessary official activities impinge as little
as possible on
citizens' rights. Against that background, the current criteria for
authorising
interception and surveillance are objectionably vague and overboard.
One of the most objectionable aspects of the Bill is that it will allow
the executive - politicians
and officials - to authorise themselves to conduct surveillance rather
than on the basis of a
court order.
It may offer some comfort to know that the Home Secretary has, as
required by Section 19 of
the Human Rights Act 1998 (which incorporated the European Convention
on Human Rights)
formally made the following statement: "In my view the provisions of
the Regulation of
Investigatory Powers Bill are compatible with the Convention Rights."
When the Home
Secretary says the R.I.P. Bill will secure "a better balance between
law enforcement and
individual rights" it is certain that it is the former's interest he
has in mind and not the latter's.
Analysis: section by section
R.I.P. Bill to introduce far-reaching
surveillance
The Bill will legitimise existing clandestine practices and introduce
controls over encryption - all on the authority of politicians and
officials
The Regulation of Investigatory Powers Bill has 73 clauses and 4
lengthy Schedules plus 357
points in the "Explanatory Notes". It is presented in three main
sections: Part I - Interception
of communications; Part II - Intrusive Investigation Techniques; Part
III - Decryption powers.
Part I - Interception of communications
This section incomprehensibly starts with defining "unlawful
interception" which covers
interception by anyone not authorised by the state (Home Secretary,
judge or a host of
others). Though it makes "lawful" real-time interception (as it is
happening) if carried out by a
person who has the right to "control the operation or use of the
system" or who has "the
express or implied consent of such a person" (Article 1.6). This
proposed lawful power
extends to collecting and storing a communication that "is being, or
has been, transmitted" or
while being transmitted is "diverted or recorded" and to "data attached
to a communication"
(Article 2.7, 2.8, 2.9).
Article 3 plunges straight into "Lawful interception without a warrant"
(both post and
communications). It is lawful, without a warrant, if one of the parties
(the sender or receiver)
consents or if "surveillance.. has been authorised in Part II" (covert
investigations).
Article 4 extends the categories where interception is "lawful" without
a warrant. It covers
prisons, hospitals and patients under the Mental Health Act 1983. It
also covers any
"business", which can by authorised by the Home Secretary by
regulation, to monitor or
record all communications conducted by that business. "Business" in
this section is defined as
including government departments, "any public authority" and any person
given authorisation.
This Article also makes "lawful" the interception of communications in
line with the EU draft
Convention on Mutual Assistance in criminal matters without a warrant.
It allows the
interception of communications of a person in another country through
telecommunications
systems based in the UK due to an interception warrant issued in that
country. No limits are
placed on the use made of the intercepted material, ie: it does not
have to be used for the
grounds on which the interception was requested.
Article 5 finally gets around to dealing with instances where a warrant
is needed for the
interception of telecommunications and postal services.
Article 5.1.b. covers intercepting communications (post and
telecommunications) at the
request of a non-UK state or agency under an "international mutual
assistance agreement".
While Article 5.1.c. allows the Home Secretary to request interception
of communications
outside the UK. Article 5.1.d. covers "intercepted material" and
"communications data"
(electronic communications).
Article 5.1.3 sets out the criteria for issuing warrants: a) "in the
interests of national security"
(valid for up to six months); b) "for the purpose of preventing or
detecting serious crime" (valid
for up to three months); c) "for the purpose of safeguarding the
economic well-being of the
UK" (valid for up to six months, for people outside the UK); d) for
international mutual
assistance agreements.
Hidden at the back of this lengthy Bill in section 71 (2) and (3) is
the definition of "serious
crime". This includes:
conduct by a large number of persons in pursuit of a common purpose
The Explanatory note says this reflects Article 8 of the European
Convention on Human
Rights which refers to "disorder and crime".
The concept of "national security" is as usual not defined and is
subject to the changing
perceptions of governments, ministers and officials of all kinds.
Liberty, observes: "If
Parliament has not judged an activity sufficiently grave or insidious
to justify bringing it within
the criminal law, then it should not generally be regarded as a
legitimate basis for interception
or surveillance."
Article 5.6 says that an interception warrant covers "all such
conduct.. as is necessary to
undertake in order to do what is expressly authorised or required by
the warrant."
Article 6 sets out the agencies which can request an interception
warrant: MI5, MI6, GCHQ,
NCIS, the police, customs, Permanent Under-Secretary at the Ministry of
Defence plus
non-UK states and agencies under mutual assistance. For international
mutual assistance a
"senior official" can issue a warrant where the person under
surveillance is outside the UK
(including "real-time" surveillance). Where it involves satellite
telecommunications (Iridium-like
"ground stations") warrants a senior official can issue a warrant
"without further formality" as
the UK is apparently not concerned with the validity or not of the
warrant issued by the
non-UK state or agency.
Article 8.3.b. provides that the Home Secretary has to issue a
"certificate" setting out a
"descriptions of intercepted material" required - this is directly
relevant to telecommunications
service providers. Article 11 sets out penalties for failure to
cooperate: up to two years or an
unlimited fine or both on indictment or up to six months or a fine or
both in a magistrates court
(summary conviction). Article 12 sets out obligations on service
providers to assist in
interception.
Articles 16 says that no reference or assertion may be made in any
legal proceedings to the
existence or not of an interception warrant. Article 17 allows
exceptions for the prosecution
and a judge to be shown the evidence - but not the defence.
Article 18 provides draconian sentences for people who reveal the
existence of an
interception warrant or the content of a communication or communication
data (not the
contents but the details of the sender and receiver of a message)
revealed by the surveillance,
including everyone who works for the postal service or for a
telecommunications provider
(including ISPs). This information is to be kept "secret" for all time.
It provides for up to five
years in prison or an unlimited fine or both on conviction.
Obtaining and disclosing "communications data"
Article 20 includes the definition of "communications data" as
including "any information which
includes none of the contents of a communication". This obscure
definition can best be
understood by looking at the categories of information set out in an EU
document -
ENFOPOL 98 (the EU-FBI surveillance plans). This says the law
enforcement agencies need:
the IP address, customer account no and address, logon ID and password
used, PIN
number, e-mail address and any credit card details. It would also
details of messages sent and
received and to/from whom. The Article also covers the postal services.
The Article allows for authorisations (as distinct from warrants above)
and the serving of
notices by "a person designated" (see below) on the following grounds:
a) "in the interests of national security"
b) "for the purpose of preventing or detecting crime or of preventing
disorder"...
c) "in the interests of public safety"
The test here is quite different and simply defined as "crime" (not
serious crime) with
"disorder" added. It also covers protecting public health, collecting
taxes, and "for any
purpose.. specified.. by an order made by the Secretary of State"
(Article 21.h, emphasis
added).
Article 21.3 allows a person in a "public authority" (to be set out by
the Home Secretary) to
anybody else in the same authority to issue an authorisation/notice on
a communications
provider for communications data (for a period of up to one month,
renewable).
Article 21.4 says that where it "appears" to the potentially thousands
of "designated" people in
public authorities that a "postal or telecommunications operator is or
may be" (emphasis
added) in possession of communications data they can serve a "notice"
on them to obtain and
disclose this to them whether "old" data or new data.
The assumption that access to communications data is a lesser intrusion
into the rights of
privacy that interception is unacceptable.
PART II:
Surveillance and "covert human intelligence sources"
The core of a surveillance state is the combination of intercepting
communications and direct
sources (informants and listening devices). Part II of the R.I.P. Bill
makes lawful previous
dubious and "unlawful" practices.
Three types of surveillance are to be "authorised":
a) "directed surveillance": this is so called on the grounds that
"surveillance is directed if it
is covert but not intrusive" (Article 25.2).
The grounds for issuing authorisations for "directed surveillance"
include "national security",
"preventing or detecting crime or of preventing disorder", and for "any
purpose" laid down by
the Home Secretary (Article 27.3).
The people able to issue authorisations are those "offices, ranks and
positions with relevant
public authorities" laid down (but not set out here) by the Home
Secretary.
b) "intrusive surveillance": surveillance is "intrusive" if it is
"covert surveillance".
Surveillance is thus "intrusive" if a device (whether to record sound
or video) is put in a
"residential premises" (but by implication not if it is not a
residential premises, like place of
work or meeting place). It is intrusive if it involves as it is
politely termed "an individual" (ie:
undercover agent or informant). It is also intrusive if a listening
device is in a vehicle, but it is
not "intrusive" if a tracking device is attached to a vehicle to plot
its location. However, it is
"intrusive" if a "device" outside a premises or vehicle produces
information of the "same quality
and detail" as might be obtained from a device actually present in the
premises or vehicles.
The grounds for issuing authorisations for "intrusive surveillance"
include "national security",
"preventing or detecting serious crime", and for "any purpose" laid
down by the Home
Secretary (Articles 30 and 33).
The people able to issue authorisations are "senior authorising
officers" in the police, military
or customs. Police and customs have to refer authorisations to the
Surveillance Commissioner.
c) "the conduct and use of covert human intelligence sources": covers
"inducing, asking
and assisting" a source. What the term "inducing" means is not set out
("inducing" could include
turning a blind eye to a criminal offence). The "covert" source is
exempted from civil liability
for "incidental" conduct (Article 26.2.a) and the "conduct" can be
authorised for "conduct"
outside the UK (the terminology is original). Although not spelt out
"covert human intelligence
sources" cover undercover agents, paid and unpaid, and "induced"
informants.
The grounds for issuing authorisations for "the use of a covert human
intelligence source"
include "national security", "preventing or detecting crime or of
preventing disorder" (a lesser
standard than for "intrusive" surveillance), and for "any purpose" laid
down by the Home
Secretary (Article 28.).
The people able to issue authorisations are those "offices, ranks and
positions with relevant
public authorities" laid down (but not set out here) by the Home
Secretary.
PART III:
Investigation of electronic data protected by encryption
This Section of the Bill introduces notices requiring service providers
to disclose encryption
"keys", known as a "section 46 notice". The grounds for such a notice
include: "national
security" and "preventing and detecting crime" (again a lesser
standard). Failure to surrender a
"key" could land a person in jail for up to two years or an unlimited
fine or both. However,
failure to keep "secret" the fact that a "key" has been given to a
state agency can bring a jail
sentence up to five years.
These proposals fail to address the fact that parties (sender and
receiver) can encrypt
messages "at source", the "key" in these cases would not be in the
hands of the service
provider. For a more detailed critique of Part III see:
http://www.fipr.org.uk
Commissioners and the Tribunal
Two Commissioners are to be appointed, the Interception of
Communications Commissioner
and the Covert Investigations Commissioner as is a Tribunal (to hear
complaints). The
Tribunal, along the lines of the existing ones covering interception
and the security services,
has powers (to hear evidence without the complainant being present and
to suppress any
evidence which would endanger the "public interest" etc).
Conclusion
A number of overall comments need to be made. First, the concept of
"crime" used to justify
such surveillance. "Serious crime", used in the powers for
interception, includes "conduct by a
large number of persons in pursuit of a common purpose" which could be
used against
political groups and activists and/or demonstrations. In other areas
there is the lesser test of
simply "crime", any crime however minor. While the provisions on
"communications data" and
covert, undercover, surveillance are expressly extended to cover
"disorder".
Second, the power, whether under warrants or authorisations, given to
state agencies (police,
customs, immigration, tax, health bodies and local authorities) to
undertake surveillance
amount to self-authorisation by politicians or officials. Liberty say:
Retention of executive rather than prior judicial authorisation of
interception is
fundamentally objectionable. That the executive should secretly
authorise itself to
commit clandestine interferences with important rights is neither
acceptable or
necessary.
Third, there is nothing to prevent the issuing of a warrant,
authorisations or notices to cover an
organisation or group and hence for the conducting of general
surveillance ("fishing or trawling
expeditions").
Fourth, the whole emphasis on the Bill is that the use of all these new
legal powers is to be
kept secret - and like the Official Secrets Acts the people involved
have to take their "secrets"
to the grave.
The fact that the Home Secretary has assured the nation that the R.I.P.
Bill is in line with the
European Convention provides little comfort. Nor will the appointment
of two
Commissioners, whose role will be defined by the open-ended powers
given for surveillance.
The Tribunal can be expected to be as toothless as the existing ones -
which have never found
in favour of a complainant. But then how can people know they are under
surveillance, for
proper or perverse reasons, if they never find out?
The Data Protection Working Party for the European Commission said in
its report in May
1999 that:
a person under surveillance [should] be informed of this as soon as
possible.
This would ensure a proper test of whether or not the surveillance was
legitimate (see
Statewatch, vol 9 nos 3 & 4). The government's analysis of the
responses to it's consultation
paper on interception says this is "an idea that law enforcement felt
to be unworkable".
It may be a sad truism but too often this government when it lays down
new legislation
affecting civil liberties diminishes the rights of the people at the
expense of the demands of "law
and order" and the "law enforcement agencies", diminishing privacy and
freedoms bit by bit
and Bill by Bill.
Sources: Regulation of Investigatory Powers Bill; R.I.P. Bill
Explanatory Notes; Regulatory Impact
Assessment, Parts I and III; FIPR press release, 10.2.00; R.I.P. Bill:
Second reading briefing, Liberty,
28.2.00; Interception of Communication in the UK, Consultation Paper,
Home Office, June 1999;
Interception of Communication in the UK: An analysis of responses to
the governments' consultation
paper (CM 4368), 15.12.99.
--------END--------------
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
