Category: Surveillance

Bigger Brother

The Coalition Agreement states that the government “will end the storage of internet and e mail records without good reason.”  This commitment is now in tatters as the Government wants the power to be able to monitor the calls, emails, texts and website visits of everyone in the UK.

The new law, which may be announced in the forthcoming Queen’s Speech in May, will require Internet firms to give intelligence agency, GCHQ, access to communications on demand, in real time. However it will not allow GCHQ to access the content of emails, calls or messages without a warrant. Civil liberties groups including Big Brother Watch have condemned this move as an unacceptable invasion of privacy.

At present Internet service providers are obliged to keep details of users’ web access, email and internet phone calls for 12 months, under the EU Data Retention Directive 2009. While they keep a limited amount of other data already on their own subscribers for billing and other commercial purposes, the new law will require them to store a much bigger volume of third party data such as that from Google Mail, Twitter, Skype and Facebook that crosses their servers every day.

This is not the first time this idea has been floated. In October 2010, the Government announced its intention to introduce the Interception Modernisation Programme, at a cost of  £2billion. This latest announcement seems to be the same project but renamed “the Communications Capabilities Development Programme (CCDP)”. Details of the scheme will be published within weeks and will build on Labour’s abandoned proposal  (which was heavily criticised by the Coalition partners at the time) to require communications service providers (CSPs) to collect and store the traffic details of all internet and mobile phone use, initially in a central database.

The Law

Access to Communications Data in the UK is already governed by Part 1 Chapter 2 of the Regulation of Investigatory Powers Act 2000 (RIPA) (sections 21-25). This sets out who can access what type of communications data and for what purposes. This includes the police and security services as well as councils, government departments and various quangos. The legislation restricts access to the different types of communications data depending on the nature of the body requesting it and the reason for doing so.

The definition of “communications data” includes information relating to the use of a communications service (e.g telephone, internet and postal service) but does not include the contents of the communication itself.  Such data is broadly split into three categories: “traffic data” i.e. where a communication was made from, to whom and when; “service data” i.e. the use made of the service by any person e.g. itemised telephone records; “subscriber data” i.e. any other information that is held or obtained by an operator on a person they provide a service to.

Some public bodies already get access to all types of communications data e.g. police, security service, ambulance service, customs and excise. Local authorities are restricted to subscriber and service use data and even then only where it is required for the purpose of preventing or detecting crime or preventing disorder.

At present access to communications data is done on a system of self authorisation. There are forms to fill (signed by a senior officer) out and  tests of necessity and proportionality to satisfy. Notices have to be served on the service provider requesting the data.

Real Time

It is unclear as to how the new proposals will be different from the current system. There is talk of the security services being able to access data in real time. The current system normally gives access to historic data. It does allow real time access to certain organisations (including the police and security services) but only in an emergency to save life or limb or in exceptionally urgent operations. The authorisation forms still have to be completed and signed and served later on though. Maybe they are suggesting that the security services get carte blanche direct access into communications service providers’ systems. This would be unprecedented and certainly “Orwellian” to say the least. The potential for abuse would be massive.

Updating the Law

The Home Office Minister says they are updating the law “in terms of social media and new devices” – it is widely expected to include things like Facebook and phone calls via web-based systems such as Skype. If this means the agencies knowing when an individual visits these sites this is already allowed under the current regime known as traffic data (web browsing information). If the new system goes further and allows agencies to look at actual webpages visited  within a domain (e.g Facebook) and calls made (e.g from Skype) this would be a big extension of existing powers and much more intrusive. It gives the possibility of building up a picture of someone’s lifestyle, their movements, contacts, interests etc.; potentially  vast a amount of information which, if it gets into the wrong hands, can be quite damaging to individuals.

Safeguards

At present the checks and balances are very weak (self authorisation followed by a notice to the CSP). The proposals, which talk of access in “real time” and “on demand”, require much stronger checks and balances.

If it is really necessary for GCHQ to have access to such a vast amount of information, it should be subject to judicial approval. This could be a similar system to the one which councils will be subject to as a result of the changes to the RIPA regime to be made by Protection of Freedoms Bill. In the future any local authority request for communications data (however minor) will have to be approved by a Magistrate. (See my earlier Blog Post for more detail about the Bill.) After all, the powers that the police and intelligence agencies have under RIPA to undertake surveillance and acquire communications data are much wider than those of local authorities.

There are also legitimate concerns about what would happen if the information held and accessed on individuals by GCHQ gets into the wrong hands. Can we really trust the law enforcement agencies not to mishandle such data? Only recently allegations have surfaced that that the police have been misusing their powers under RIPA to assist the tabloids to locate the whereabouts of celebrities and other persons of interest.

The Government needs to think carefully about its plans. If these new proposals are enacted there is a massive potential for misuse. It will provide a rich seem of information which may be bought by journalists from unscrupulous police and intelligence officers. This could lead to further erosion of trust in the police and Government. Of course “the Devil is in the detail” and we wait to see how the Government will address these concerns.

We have a series of courses on RIPA and Surveillance which also over the changes in the Protection of Freedoms Bill.

See also our RIPA Forms Guidance Document.

Act Now Book Draw Week 6

The winner of this week’s Act Now Book Draw was Peter Dinsdale from Newcastle University.

Next week’s bookGringras: The Laws of the Internet (3rd Edition) is Gringras: The Laws of the Internet (3rd Edition) by Elle Todd.

The next draw will take place on Wednesday 4th April at 9am. Click here to enter the draw.

If you enter the draw and win, you give us permission to let others know that you have won (by e mail, on our website and by Twitter). If you do not want us to do this, please do not enter the draw. Any information we receive through this free draw will not be used for any other purpose.

FPN & CCTV

Not sure why but when a normally rational DP officer is asked to produce a Fair Processing Notice for a CCTV camera they seem to lose track of reality and forget the basics. Name of Data Controller; purpose of processing, contact details.

Here’s a simple example.

Forgot almost everything and also made the mistake of telling people that they were using hidden cameras. Hidden engages RIPA. Easy mistake to make.

Another fine example of this on the right is a well known police force.

Clearly they thought about what to put on their sign but managed to get it spectacularly wrong.

And while the Act Now staff are abroad they also keep their eyes open for interesting signs. Souriez means Smile. We’ve seen versions of this in the UK.

And a colleague sent the following to me knowing I had a library of CCTV signs collected on my travels.

 

 

 

 

How we laughed… But then we realised… what do our CCTV signs look like? Is anyone snapping ours and showing them off as not actually very good…   Send us your signs.

CCTV and the Law Workshop – Watching You Watching Them More details – http://www.actnow.org.uk/courses/714

RIPA it up and start again?

At a time when the phone hacking scandal has shone a spotlight on the murky world of police and tabloid surveillance, the Government, through the Protection of Freedoms Bill, is choosing a soft target in local authorities rather than focusing on the real culprits.

The Bill is currently proceeding through the Committee Stage in the House of Lords. If passed in its current form, it will require local authorities to have all their surveillance authorisations under the Regulation of Investigatory Powers Act 2000 (RIPA) (Directed Surveillance, CHIS and the acquisition of Communications Data) approved by a magistrate before they take effect.

Most local authorities feel that this is a disproportionate response to inaccurate media stories about their “overzealous” use of RIPA. When the the Coalition Government published the Bill in February 2011, the Home Secretary, announced:

“The first duty of the state is the protection of its citizens, but this should never be an excuse for the government to intrude into peoples’ private lives. Snooping on the contents of families’ bins and security checking school-run mums are not necessary for public safety and this Bill will bring them to an end. I am bringing common sense back to public protection and freeing people to go about their daily lives without a fear that the state is monitoring them.”

The reality is that most authorities only use their powers in a handful of cases each year and only when there is no other viable means of investigating offences and then in a reasonable and proportionate manner. The latest annual report by the Office of Surveillance Commissioners (2010/2011) states:

“Generally speaking, local authorities use RIPA/RIP(S)A powers sparingly with over 50% granting five or fewer directed surveillance authorisations during the reporting period. Some 16% granted none at all.”

By contrast, it seems that there is a much more convincing case for stronger regulation of media (especially the tabloids) and police surveillance. The setting up of the Leveson Inquiry and the inquiry by the House of Commons Select Committee on Culture, Media and Sport meant that at first the primary concern was about allegations of phone hacking by the News of the World. However it has now become clear that hacking phones was just one part of the unscrupulous journalist’s toolkit. It also included buying information from the police, blagging sensitive personal information from public and private sector organisations and the hacking politicians’ computers to gain access to their e mails.

Allegations have also surfaced that that the police have been misusing their powers under RIPA to assist the tabloids to locate the whereabouts of celebrities and other persons of interest. Working with mobile phone companies, the police have the ability to pinpoint a phone by monitoring which signal masts it is using and triangulating its location. This involves the acquisition of “traffic data” under Chapter 2 of Part 1 of RIPA and has to be properly authorised in writing by a senior police officer. The technique is known as “pinging”. It is meant to be used in the most serious cases e.g. kidnap and murder cases to locate the whereabouts of victims and suspects. It is not designed to help journalists locate a celebrity or to track a premiership footballer “playing away from home.”

From the various media reports it seems that the police have a serious case to answer about RIPA misuse. Why were powers which were enacted to assist the police to investigate serious criminal offences being abused for commercial gain? Surely, if the reports are true, there is a stronger case for judicial approval of police RIPA communications data powers than those of local authorities who occasionally use them to obtain the identity of a rogue trader or fly tipper? It may be time to amend the Bill to include the police in the requirement to seek Magistrates’ approval?

At present Part 2 of RIPA (covert surveillance) only covers public authorities. The tabloids often use questionable covert surveillance tactics which are unregulated. In November 20011 the BBC reported that The News of the World hired an ex-police officer in 2010 to carry out surveillance on two prominent lawyers, Mark Lewis and Charlotte Harris, who were representing phone hacking victims. The investigator is reported to have filmed members of Mr Lewis’s family, including his teenage daughter, on a shopping trip. These allegations were subsequently confirmed by both lawyers when giving evidence to the Leveson Inquiry.

It’s fair to say that the tabloids, by doing covert surveillance, have had more of an impact on individuals’ privacy than local authorities. Currently there is no law, which comprehensively regulates these activities. Some may lead to trespass, harassment or a breach of the Data Protection Act 1998. The government would do more to protect peoples’ civil liberties by turning its attention to media surveillance than local authority surveillance, which is already properly regulated. There is now a very strong case for bringing the media within the scope of the RIPA regime. Local authorities should be left alone, without further regulation, to continue what they have, in the majority of cases, been doing in a necessary and proportionate manner.

We have a series of courses on RIPA and Surveillance which also cover the changes in the Protection of Freedoms Bill. See also our RIPA Forms Guidance Document.