No slow DRIP: Expansion of surveillance powers being rammed through Parliament
Despite having over three months to introduce legislation responding to the Court of Justice of the European Union striking down the Data Retention Directive , an 'emergency' surveillance bill is being rammed through Parliament this week.
Not only does the Data Retention and Investigatory Powers Bill (DRIP) fail to address the privacy concerns laid out in the Court's judgment, it also drastically expands spying powers of the State. Worringly, just this afternoon, the fast track timetable was approved this afternoon by the House of Commons despite opposition from 49 MPs.
A final vote on DRIP is expected later this week. Below are the concerns laid out in a briefing from Liberty, Privacy International, Open Rights Group, Big Brother Watch, Article 19, and English PEN. Even without any significant Parliamentary scrutiny and debate, we call on MPs to amend the Bill's sunset clause to make DRIP expire at the end of the year. Given what we have learned over the past year about State surveillance, and the public's growing discomfort with its secretive nature, the public deserve an open debate about how and under what conditions our agencies can spy on us.
Disregard for democratic process and rule of law
While Government claims DRIP is merely responding to the CJEU decision and 'clarifying' existing surveillance powers, this could not be further from the truth. DRIP makes no effort to address the main concern laid out in the CJEU ruling: that blanket data retention is a significant interference with the right to privacy. Further, DRIP greatly extends the State's communications interception powers overseas under the Regulation of Investigatory Powers Act (RIPA). For instance, under DRIP the government could compel foreign companies – including commonly used internet services like Yahoo! and Facebook – to assist them in achieving their surveillance aims.
Under DRIP, the legally questionable TEMPORA programme could be extended globally, where we could see mass surveillance warrants served on owners of submarine cables that do not even pass through the UK. The timing of this legislation could not be more audacious, as just this week Privacy International, Liberty, and Amnesty International meet with GCHQ in court challenging the TEMPORA programme and information sharing between the UK and US governments.
In both process and substance, DRIP shows an utter disregard for the democratic process and the rule of law. The misleading information coming from our elected leaders is an affront to the British public, which has led to leading legal academics across the UK to debunk the assertion that the bill contains no new surveillance powers as false. In an open letter to Parliament, the scholars said that DRIP
goes far beyond simply authorising data retention in the UK. In fact, DRIP attempts to extend the territorial reach of the British interception powers, expanding the UK’s ability to mandate the interception of communications content across the globe. It introduces powers that are not only completely novel in the United Kingdom, they are some of the first of their kind globally."
The letter continues, "DRIP is far more than an administrative necessity; it is a serious expansion of the British surveillance state."
Addressing data retention
The EU Data Retention Directive has been criticised for violating the Charter of Fundamental Rights of the European Union and the European Convention on Human Rights since it was passed in 2006. When the ruling came down in April striking down the Directive, we wrote to the Home Office seeking clarity on what their next steps were. Aside from a quasi-dismissal of the CJEUs concerns, it doesn't appear that DRIP has made an effort to comply with the CJEU judgment which had laid out 10 principles that data retention must comply with (paragraphs 58-68 of the ruling here).
DRIP re-enacts the practice allowing for mandatory blanket communications data retention of the entire population for up to 12 months, a practice which has already found to be unconstitutional in many European states including Germany, Romania, Belgium, Austria and Greece amongst others. DRIP also fails to address the very real privacy concerns laid out in the judgment, and does not address the existing lax regime under which personal data can be accessed.
Despite the Court being clear on the private nature of communications data (metadata), there is no such acknowledgment in DRIP. Government continues to diminish the importance of metadata - the who, when, what, and where of communications - despite public statements from intelligence officials on how much it reveals. While the Government does rely on communications data for counter-terrorism, serious crime and financial crime operations, the 514,608 requests for this data in 2013 alone shows an unnecessary and disproportionate usage of communications data in their work, so much so that the UK Interception Communications Commissioner warned that it "seems to me to be a very large number. It has the feel of being too many".
Just as the Directive was incompatible with human rights, so too is this rushed bill. Rather than assuaging these concerns, DRIP is a power grab dressed up as emergency legislation.
Expansion of surveillance powers
DRIP seeks to crystallise and extend the powers of existing UK legislation covering interception and surveillance (RIPA), powers that are currently under scrutiny by the Investigatory Powers Tribunal. DRIP would allow the Government to issue interception warrants mandating mass surveillance outside the UK. This extra-territoriality power is a clear expansion of the existing regime, allowing the government to issue interception warrants to telecommunication companies and ISPs around the world. These companies would be compelled to not only assist in the interception of emails and phone calls, but also require backdoors to be build into communications infrastructure.
These exact powers were shot down when the Draft Communications Data Bill was dismissed more than a year ago. Deputy Prime Minister Nick Clegg, who in this go around has joined the Prime Minister and Labor opposition leader in endorsing DRIP, said previously that such powers would put the UK in a tight spot by losing the “ability to speak out as a leading voice for internet freedom.” While the Global Network Initiative, a multistakeholder group which includes some of the world's leading internet companies, made this exact point in its opposition to DRIP, Clegg himself seems to have forgotten his own words.
DRIP not only expands surveillance powers, but also redefines the meaning of 'telecommunications service', which will now include "companies that provide internet based services such as webmail." While providers such as Gmail would now be compelled under RIPA to turn over user data, it is unclear if this applies to other prevalent social networks and tools.
Examples from recent history show the democratic process being used and abused in times of 'emergency', which result in bad laws or laws with unintended consequences. With the scale and reach of the security services together with the rapid evolution of technology, caution and thought is urgently needed when introducing legislation that affects the very core of our fundamental freedoms.
If the Snowden documents have shown us anything, it is that Government is taking a very loose approach to how it interprets its surveillance powers. What is concerning now is that DRIP expands and solidifies those powers. If this bill merely 'clarifies' what it is already doing, then it is impossible to know how they will begin to execute the law now that they granted themselves even more capabilities.