Investigatory Powers Act 2016

(Redirected from Investigatory Powers Bill)

An Investigatory Powers Bill was announced in the Queen's Speech in May 2015[1]. "New legislation will modernise the law on communications data"

It included elements of the previous Communications Data Bill.

Data retention and acquisition

Retention of communications data

Internet Connection records

The “filter”

Internal authorisation by police and other authorities

Bulk powers

Bulk collection

Bulk personal datasets

Bulk hacking

Oversight arrangements

Authorisation regime

Equipment interference

Part 5 (Equipment Interference Warrants) and Chapter 3 of Part 6 (Bulk Equipment Interference Warrants) deal with “equipment interference.” Under the Part 5, a warrant can be issued in order to achieve Targeted Equipment Interference and Targeted Examination.(Article 99 (1)[2])


Targeted Interference

What information could be obtained

Targeted Equipment Interference Warrant is a warrant which authorises or requires the person to whom it is addressed to secure interference with any equipment, e.g. laptop or mobile(Article 99 (2)[3]) It purports to obtain communications data, equipment data, and any other information.(Article 99 (2)[4])

According to Article 99 (4)[5], obtaining communications includes;

(a) monitoring, observing or listening to a person’s communications or other activities;
(b) recording anything which is monitored, observed or listened to.

Subject to Section 100[6], equipment data comprises two sets of data; systems data and identifying data. (Article 177 (1), (2)[7]) systems data is any data that is connected with enabling, facilitating, identifying, or functioning postal/telecommunications services and any other systems holding communications or other information. (Article 263 (4), (5)[8]) The implication is that not only text message but every other kind of data - photo image, picture, video file, voice recording - could be obtained under the Targeted Equipment Interference Warrant.


Safeguards for Targeted Equipment Interference

Subjected Communications

Additionally, so long as expressly noted in the warrants, any conducts ancillary to obtaining the stated data/information is authorised. (Article 99 (5)(a)[9]) Also, in pursuance of the requirements provided by warrants, any assistance for the observation of them would be authorised. (Article 99 (5)(b)[10]) On the other hand, the same warrant may not authorise or require a person to touch on the communication other than stored communication. If he/she have done so, it amounts to an offence under Part 3 unless it is done by legal authority. (Article 99 (6)[11]) Stored communication is communications stored in/by a telecommunications system, including one before and after transmitted. (Article 99 (8)[12])

In other words, Targeted Equipment Interference Warrants cannot be used for the purpose of intercepting the transmission. This is why the nearly real-time surveillance is eagerly pursued by the government in a form of a TCN.


Lawfulness

The purpose of the warrant needs to be necessary on the grounds of; the interests of national security preventing or detecting serious crime the interests of the economic well-being of the UK (Article 102 (5)[13])

Of the three, national security serves as the strongest case. preventing or detecting serious crime cannot stand by itself (Article 102 (2)(a)[14]), and economic well-being of the UK is counted so far as relevant to national security and only where the information sought relates to actions and intentions of the person outside the UK. (Article 102 (6)[15])


British Island Connection

Article 107[16] sets out restrictions on the issuance of Targeted Equipment Interference Warrant. The tenet of the Article is the authorities issuing Targeted Equipment Interference Warrant must consider that there is the presence of the British Islands connection. (Article 107 (1)[17])

The said connection arises when;

(1) the conduct authorised under the warrant takes place within the UK;
(2) the equipment interfered is or may be. at some point of the interference, within the UK
(3) the purpose of the warrant is to obtain the communication and/or information involving the person who is, or believed to be, within the UK. (Article 107 (4)[18])

Hence, the scope of Targeted Equipment Interference is apparently limited to conduct, equipment, or person in the UK. However, the law enforcement authorities are not under the strict obligations to confirm the connection but mere consider suffices.


Judicial Review

Judicial Commissioners must review the warrants in terms of necessity and proportionality, using the same principles as applied by a court. (Article 108 (1), (2), (3)[19]) Nevertheless, Judicial Commissioners can refuse to make a review.(Article 108 (4)[20]) In such a case, Judicial Commissioners have to tell the person made an application for the warrant in a written form. (Article 108 (4)[21]) Investigatory Powers Commissioner may be asked to make a decision instead of Judicial Commissioners then. (Article 108 (5)[22])

Data Retention and Sharing

Sections 129 and 130 have relevant clauses. See 5. International data sharing and other arrangements[23]

Bulk Equipment Interference

Cross-border Surveillance

In relation with territorial safeguards for Targeted Equipment Interference, Bulk Equipment Interference Warrants aims to reach any people with a non-established connection with the UK and the data/information of their equipment and communications.

Article 176[24] provides for Bulk Equipment Interference Warrants in order to obtain overseas-related communications, overseas-related information, and overseas-related equipment data (Article 176 (1)(c) of the Act). Overseas-related information means any information on individuals outside the UK (Article 176(2) of the Act). Overseas-related equipment data means any data which may assist in identifying the persons concerned in targeted communications or related to overseas-related communications or/and data (Article 137(5).[25],176(3)[26], and 177[27])


Safeguards for Bulk Equipment Interference

Lawfulness

As stated in Article 176, Bulk Equipment Interference Warrant should seek to obtain overseas-related communications, information, and equipment data. (Article 178(a)[28]) The purpose of the warrant is necessary if it is for;

(a) the interests of national security (Article 178 (1)(b)(i)[29])
(b) preventing or detecting serious crime
(c) the interests of the economic well-being of the UK (Article 178 (1)(b)(ii), (2)[30])

Second grounds are quite similar to the one in Article 102 (5)(b) but that preventing and detecting serious crime can stand alone for the grounds in itself as contrary to Article 102 (2)(a)[31]


Judicial Review

The review system for Bulk Equipment Interference is almost identical to that for Targeted Equipment Interference. In an emergency case which SoS considers as such, a warrant is to be issued without prior judicial review. (Article 178 (1)(f)[32])


Exception for Safeguards: Targeted Examination Warrants

Targeted Examination Warrant is a warrant which authorises or requires the person to whom it is addressed to carry out the selection of protected material obtained under Bulk Equipment Interference warrant for examination in breach of the prohibition in Section 193 (4) [33]. (Article 99 (1)[34]</ref>)Section 193 (4) prohibits to seek to identify communications of, or private information relating to, individuals within the UK.

Article 99 (9)[35] explains the meaning of protected material in a complex manner but examining protected material fundamentally equals to deciphering private information on a person’s private or family life. (Article 135 (1)[36]), 198 (1)[37]) Accordingly, by a combination of Bulk Equipment Interference and Targeted Examination Warrants, information and communications relating to a person who does not have a British Island connection could also be obtained.


Technical Capability Notices

Definition

Article 253 (2)[38]

defines a Technical Capability Notice (TCN) as  “a notice—
(a) imposing on the relevant operator any applicable obligations specified in the notice, and
(b) requiring the person to take all the steps specified in the notice for the purpose of complying with those obligations.”

It must be given in a form of written communication. (Article 255 (5)[39])


Contents

A TCN must have a finite period of within which obligations therein are exhausted and may have different timescales along with different steps.(Article 253 (7)[40])


The actual contents of the obligations that are included in a TCN may be specified by Regulations under Article 253 (4)[41] insofar as SoS considers it is reasonable in order to secure that the operators have the capability to assist implementing relevant authorisations and ensure they can comply with a TCN. (Article 253 (4) (a), (b)[42]) Such obligations cover a wide range of issues, e.g. provision of necessary facilities. (Article 253 (5)[43], see also Investigatory Powers Act 2016/Investigatory Powers (Technical Capability) Regulations 2017 particularly at 4.1)


Whatever the obligations are, it is enforceable and the addressee must comply with them if they relate a person in the UK.(Article 253 (9), (10)[44]) Furthermore, Article 255 (11)[45]

states that even regarding a person outside the UK, the obligations must be done so long as they are involved in;
(a) a targeted interception warrant or mutual assistance warrant under Chapter 1 of Part 2;
(b)a bulk interception warrant;
(c)an authorisation or notice given under Part 3.


Broad range of subject and scope

A TCN is issued by Secretary of State (SoS) toward a postal operator and/or telecommunications operator, including those who are proposing to become them.(Article 253 (1),(3)[46]) A TCN appears to be a supplement means of achieving what is sought by any warrant issued under Part 2.5. and 6 and any authorisation or notice under Part 3.(Article 253 (3)[47]) These warrants, authorisations and notices are collectively mentioned as relevant authorisations in Article 253 (3).[48]


Moreover, a TCN may be given to persons outside the UK. Ir further may require certain measures to be taken or not to be taken outside the UK. (Article 253 (8)[49]) In such a case, a TCN can be given in either of the following ways provided in Article 255 (6)[50]: When the person has his office or other places, where his business take place, in the UK, a TCN is delivered to such locations. Meanwhile, when the person does not have the above places in the UK, a document containing a TCN can be sent and received by the address specified by the person. This address including e-mail address and the recipient does not necessarily have to be the person addressed, for the recipient will accept the document on the person’s behalf.


Therefore, if the operators do not own any contact point physically in the UK, they can still, directly or indirectly, receive a TCN and bears the obligations therein.


Insufficient review mechanism

A TCN may be given to the operators when SoS considers it is necessary and proportionate. (Article 253(1)(a), (b)[51]) and such considerations should be affirmed by a Judicial Commissioner.(Article 253(1)(c)[52]) The Commissioner must consider the necessity and proportionality of the TCN at stake. (Article 254 (3) (b)[53]) In doing so, a Judicial Commissioner must apply the same principle as invoked as the judicial court, and take into account the view of SoS on the necessity and proportionality. (Article 254 (2), (3) (a))


However, it seems that a Judicial Commissioner can refuse to make a decision by providing a written explanation of the reason. (Article 254 (4)[54]) In such a case, in place of a Judicial Commissioner, SoS may an Investigatory Powers Commissioner to decide on the approval. (Article 154 (5)[55]) There exist no provisions in the Act that oblige an Investigatory Powers Commissioner to abide by the existing principles available in a judicial court. Similarly, there are no limitations or conditions set out in the Act about when and under what circumstances a Judicial Commissioner may refuse to assess the application. This implies that a TCN might be approved without being thoroughly considered in the light of necessity and proportionality.


Other rules

Article 255 (7)[56] provides that SoS may create further provisions about the issuance of relevant notices, in a form of regulations.

International data sharing and other arrangements

Sharing data with overseas authorities

Sections 129[57] and 130[58] are positioned as clauses setting out safeguards for issuing Targeted Equipment Interference and/or Targeted Examination Warrant. (Article 102[59], 104[60], 106[61]) Although each is applicable to different situations, the substance of the safeguards enshrined in them are identical, for Section 130 follows Section 129.(Article 130 (2)[62]) Section 130 obliges the authorities issuing relevant warrants (the issuing authorities) to ensure that they never give any materials or copies thereof to the authorities outside the UK; unless securing that the requirements are satisfied which subsection (2) mentions i.e. provided in Section 129 (2) to (5).[63]


Safeguards in place?

Section 129 concerns retention and disclosure, while Section 130 concerns disclosure of materials overseas. It has a bundle of safeguard clauses. Subsection (2)[64] limits data sharing among the authorities to the minimum extent which is necessary, in terms of; the extent of disclosure and availability, in particular, the number of persons to who have access to materials and the number and the extent of copies to be made. (Article 129 (3)[65])


The necessity test appears self-repetitious and thus does not contribute to clarification. Subsection (3)[66] basically states that necessity arises if something is;

(1) or likely to become necessary on any grounds for that justifies the original authorisation.
(2) necessary for facilitating any functions of the issuing authorities or of the Judicial Commissioners or of the Investigatory Powers Tribunal under or in relation to this Act,
(3) necessary for the purpose of legal proceedings, or
(4) necessary for the performance of the functions of any person under any enactment.


The second one is about the storing. Subsection (4)[67] states that every copy of the materials must be kept secure. Thirdly it is required that once the materials lose the grounds for the retention every copy is to be destroyed as soon as possible. (Article 129 (5)[68])


These are the safeguards in necessity (minimisation), retention, and destroy. For materials held in the UK government to be shared with authorities outside the UK, it suffices that these requirements appear to be met to the issuing authority in the UK.(Article 130 (2)Article 130 (2)[69]) There are no duty on them to confirm their overseas counterparts actually have the capacity and intention to do so nor are they imposed to see if copies are kept or destroyed in accordance with requirements in Section 129.

See also

External links

References

  1. Queen's Speech 2015, 2015-05-27, GOV.UK
  2. Article 99 (1)
  3. Article 99 (2)
  4. Article 99 (2)
  5. Article 99 (4)
  6. Article 100
  7. Article 177 (1), (2)
  8. Article 263 (4), (5)
  9. Article 99 (5)(a)
  10. Article 99 (5)(b)
  11. Article 99 (6)
  12. Article 99 (8
  13. Article 102 (5)
  14. Article 102 (2)(a)
  15. Article 102 (6)
  16. Article 107
  17. Article 107 (1)
  18. Article 107 (4)
  19. Article 108 (1), (2), (3)
  20. Article 108 (4)
  21. Article 108 (4)
  22. Article 108 (5)
  23. [1]
  24. Article 176 of the Act
  25. Article 137(5) of the Act
  26. Article 176(3 of the Act)
  27. Article 177 of the Act
  28. Article 178 (a)
  29. Article 178 (1)(b)(i)
  30. Article 178 (1)(b)(ii), (2)
  31. Article 102 (2)(a)
  32. Article 178 (1)(f)
  33. Article 193 (4)
  34. Article 99 (1)
  35. Article 99 (9)
  36. Article 135 (1)
  37. Article 198 (1)
  38. Article 253 (2)
  39. Article 255 (5)
  40. Article 253 (7)
  41. Article 253 (4)
  42. Article 253 (4) (a), (b)
  43. Article 253 (5)
  44. Article 253 (9), (10)
  45. Article 253 (11)
  46. Article 253 (1), (3)
  47. Article 253 (3)
  48. Article 253 (3)
  49. Article 253 (8)
  50. Article 255 (6)
  51. Article 253
  52. Article 253
  53. Article 254 (3)
  54. Article 254 (4)
  55. Article 154 (5)
  56. Article 255 (7)
  57. Article 129
  58. Article 130
  59. Article 102
  60. Article 104
  61. Article 106
  62. Article 130 (2)
  63. Article 129 (2), (3), (4), (5)
  64. Article 129 (2)
  65. Article 129 (3)
  66. Article 130 (3)
  67. Article 129 (4)
  68. Article 129 (5)
  69. Article 130 (2)