Draft Communications Data Bill

The powers and intent of the Bill were preceded by plans under the last Labour administration to improve access to communications traffic data, under the Interception Modernisation Programme.[10] The plans did not become a firm legislative proposal and were strongly opposed by both Conservative and Liberal Democrat opposition parties.[11]

The new coalition agreement in 2010 committed to ending the storing of email and Internet records "without good reason". The IMP was not entirely abandoned however, and the Home Office under the new coalition committed to examining the problem of access to communications data under the Communications Capabilities Development Programme.[12][13][14]

The government announced its intention to legislate in order to "maintain capability" of law enforcement access to communications traffic data in 2012.[15]

As the result of public reaction to the proposed Bill and internal Liberal Democrat opposition to the Bill, Nick Clegg asked for the Bill to be referred to a Joint Committee to scrutinise the proposal. The Committee reported in December 2012.[16]

In 2015 a cross-party group of lords — Tom King, Baron King of Bridgwater, former Conservative Defence Secretary; Ian Blair, Baron Blair of Boughton, former Commissioner of Police of the Metropolis and crossbench peer; Alex Carlile, Baron Carlile of Berriew, former Independent Reviewer of counter-terrorism legislation and Lib Dem peer; and Alan West, Baron West of Spithead, former Labour Minister for Security and Counter-Terrorism — attempted to add the text of the Communications Data Bill to the Counter-Terrorism and Security Bill, which became the Counter-Terrorism and Security Act 2015.[17][18] However this was dropped before going to a vote due to opposition.[19]

The bill would create a wide-ranging power to compel any 'communications service provider' to collect and retain additional information about their users. Current data retention obligations require ISPs to retain data collected for business purposes for longer than normal. Under the new bill, any organisation that interacts with users and produces or transmits electronic communications could be compelled to collect and retain information about them, even if it is entirely irrelevant to their business needs.[20]

One technique that may be used to collect user data could be Deep Packet Inspection.

According to Office for Security and Counter-Terrorism Charles Farr, formerly of MI6, so-called "black boxes" – DPI – probes are not the "central plank" of the 2012 Communications Data Bill. The boxes would be used when communications service providers refuse to submit data, but he anticipated that most would maintain data about users in unencrypted form from which contact information could readily be separated from content. This would circumvent SSL encryption during transmission. He said that the DPI boxes were already "used as a matter of course" by ISPs.[21] The Mastering the Internet system was described in 2009 by The Register and The Sunday Times as the replacement for scrapped plans for a single central database, involving thousands of DPI "black boxes" at ISPs in association with the GCHQ base in Cheltenham, funded out of a Single Intelligence Account budget of £1.6 bn, including a £200m contract with Lockheed Martin and a contract with BAE Systems Detica.[22] In 2008 the black box infrastructure was operated by Detica, which had been expected to win additional contracts for its proposed expansion in the Communications Data Bill 2008.[23]

The bill creates arrangements to interrogate and match data from different data sources. The justification is that only relevant data would be returned, thus improving personal privacy. Additionally, police cite problems matching data from for instance different cell phone masts.

However, the bill has been said to provide the legislative basis for a "giant database" that would allow "quite complicated questions" about "communications behaviors and patterns" which could become a "honeypot for casual hackers, blackmailers, criminals large and small from around the world, and foreign states", as Lord Strasburger described it, as the bill was scrutinised by the Joint Committee of MPs and peers.[3][24]

The BBC reported that the Home Office stressed that the bill was intended for targeted surveillance rather than "fishing expeditions", but quoted opponent Nick Pickles, director of Big Brother Watch: "The filtering provisions are so broadly worded and so poorly drafted that it could allow mining of all the data collected, without any requirement for personal information, which is the very definition of a fishing trip."

Open Rights Group campaigner Jim Killock told the BBC that officials 'would be able to build up a complex map of individuals' communications by examining records of "their mobile phone, their normal phone, their work email, their Facebook account and so on",' which 'could compromise journalistic sources, deter whistleblowers and increase the risk of personal details being hacked'.[25] The human rights organization Liberty also called for rejection of what is being called the "Snoopers' Charter".[26]

The bill would change the authorisations given to police officers under RIPA. Instead of individual data requests being granted by a senior officer, the senior officer would grant powers once a month to investigating officers to conduct data requests on a topic they were investigating.

Additional changes to the role of Interception of Communications Commissioner and Information Commissioner are argued to improve oversight to the current arrangements under RIPA.

As of November 2015, no ISP has announced or made public how they will handle and store information securely.

From costs to how to power the machines, there are incredibly tough technical issues facing ISPs and some they might not be able to overcome. The sheer volume of data will push hardware software and network technologies beyond their design.

The bill proposed that the obligation imposed on ISP providers to retain data about their clients online activities is vastly expanded.[31] The current legislation allows ISP providers to retain information on clients for business purposes with a maximum time limit of 12 months. The proposed legislation will oblige communication service providers (CSPs) to retain a variety of information for 12 months and make this information available to state authorities upon request. The UK Internet Services Providers' Association (ISPA) have issued a statement raising concerns about the impact on the competitiveness of UK CSPs as it creates a less attractive and more onerous environment in which companies have to work.[32] The ISPA also question whether there is a need to expand the scope of data retention requirements and requested a more detailed explanation of what, in practice, will be required of them.[32]

Former UK Prime Minister David Cameron openly expressed a desire for encryption to be weakened or encrypted data to be easily accessible to legal forces in order to tackle terrorism and crime. This viewpoint has been widely addressed as uninformed and greatly dangerous to the privacy and information of the general public because of the dangers that this initiative would entail.[33]

A ban on encryption would result in all information stored online to be openly visible to anyone, this information would include data such as bank details that might be input on online shopping websites, addresses, personal details as well as private messages sent on messaging services such as iMessage and WhatsApp that all use encryption in order to protect the identity and information of their users.

The encryption measures currently in place work on the basis that no third party would be able to access the data and banning this practice would mean that it would open not only to the government but also to anyone interested because encryption measures are not set to be sensitive to certain access requests, they are fully protective of all data stored under those measures.

Experts have made it clear that weakening or banning encryption would be extremely dangerous and damaging to the safety of the economic Internet environment and could have great repercussion on the information stored online and how it is used.[34]

The UK is unusual in the arrangement that Ministers sign off on warrants when the inspection of bulk collected data is requested by the security services. Just under 3 thousand warrants were requested and authorized in 2014 by the Secretary of State. Typically, in most democracies, independent judges decide and sign off police warrants in the cases where surveillance is of an intrusive nature.[35] Recently published Independent Review of Terrorism Legislation calls for UK to adopt the judicial authorisation as it is practised by other developed democracies.[36]

There is a concern that No 10 will disregard the request for the reform of the oversight and the call for independent judges handling the sign off in the cases of highly intrusive surveillance.[37]

Costs have been estimated at £1.8bn over the next ten years. However the basis of the calculations used to reach this figure have not been made public.[38]