Here comes the new snooper’s charter, same as the old snooper’s charter.
Many in the technology sector had been hoping that the final version of the investigatory powers bill, released on Tuesday, would backtrack on some of the more controversial aspects of October’s draft bill. But the final version, which will now be presented to parliament, contains only the mildest of tweaks, and even doubles-down on some areas.
A fierce lobbying effort over the winter, from firms including Apple, Facebook, Microsoft and Twitter, had focused on three specific parts of the legislation where the Home Office bill looked set to do real damage to the technology industry.
The draft bill had concerned the major US technology companies for a number of reasons.
- There was a claim of “extraterritorial jurisdiction” that would allow warrants for bulk surveillance to be served to companies even if they weren’t headquartered in the UK.
- There was a requirement for firms to provide assistance with “computer network exploitation”, which they worried could lead to the UK mandating their aid in hacking their own customers – a fear which has taken on a less hypothetical sheen with the revelation that the US government is currently taking Apple to court demanding the company do just that.
- There was language suggesting that tech firms could be forced to break the encryption on messages sent using their technology – a requirement which could force companies like Apple and Facebook, which offer encrypted messaging apps, to choose between operating in Britain or breaking their own messaging apps on an international scale.
The new version of the bill does soften that last requirement, just. It offers a “pragmatic approach” on the part of the government, and makes clear that no company will be required to remove encryption of their own services if it is not technically feasible. The definition of what, exactly, constitutes technical feasibility is, however, left as an exercise for the reader – and for a lot of lawyers in the future.
But on the other areas, no changes were made.
In its response to the bill committee’s recommendations, the government said that concerns over extraterritoriality were already dealt with. “The government is engaging in preliminary discussions with international partners on how a new international framework for access to data across jurisdictions might operate in principle. This would be based on strong, human rights-compliant domestic regulatory oversight,” it said.
And the bill actually extended the proposed powers for the state to hack computers. Previously, the draft bill had only allowed the security services to carry out computer hacking (enshrining into law an ability believed to already be widely used). But the new version of the bill also allows the police to start hacking when they are dealing with a “threat to life” or missing persons, as well as the security services.
The Open Rights Group’s executive director Jim Killock concluded that “the revised bill barely pays lip service to the concerns raised by the committees that scrutinised the draft bill.
“If passed, it would mean that the UK has one of the most draconian surveillance laws of any democracy with mass surveillance powers to monitor every citizen’s browsing history.”
Eric King, the director of the Don’t Spy on Us coalition, warned that “Rather than a full redraft, we’ve been given cosmetic tweaks to a heavily criticised, deeply intrusive bill.”
King added: “There simply isn’t time for proper scrutiny of all these powers in the timeframe proposed.” On that, he was backed up by the Web Foundation, founded by the inventor of the world wide web, Tim Berners-Lee, which called the final bill “a slap in the face for British democracy”.
The time-frame is, according to the Foundation, “not only unrealistic, but dangerous.”
One major US technology firm told the Guardian that it was “hugely disappointing that the government hasn’t moved on any of the core issues, despite a wealth of evidence”. As the bill moves through parliament, that opposition is likely to intensify.